Download Operating Experience Assessment - Effects of Grid Performance

NUREG- 1784
Operating Experience
Assessment - Effects of Grid
Events on Nuclear Power Plant
Performance
*ORV REG,,
U.S. Nuclear Regulatory Commission
Office of Nuclear Regulatory Research
Washington, DC 20555-0001
-I
AVAILABILITY OF REFERENCE MATERIALS
IN NRC PUBLICATIONS
NRC Reference Material
Non-NRC Reference Material
As of November 1999, you may electronically access
NUREG-series publications and other NRC records at
NRC's Public Electronic Reading Room at
http:l/www.nrc.pov/readinp-rm.html.
Publicly released records include, to name a few,
NUREG-series publications; Federal Register notices;
applicant, licensee, and vendor documents and
correspondence; NRC correspondence and internal
memoranda; bulletins and information notices;
inspection and investigative reports; licensee event
reports; and Commission papers and their attachments.
Documents available from public and special technical
libraries include all open literature items, such <.s
books, journal articles, and transactions, Fedeial
Register notices, Federal and State legislation, and
congressional reports. Such documents as theses,
dissertations, foreign reports and translations, and
non-NRC conference proceedings may be purchased
from their sponsoring organization.
NRC publications in the NUREG series, NRC
regulations, and Title 10, Energy, in the Code of
Federal Regulations may also be purchased from one
of these two sources.
1. The Superintendent of Documents
U.S. Government Printing Office
Mail Stop SSOP
Washington, DC 20402-0001
Internet bookstore.gpo.gov
Telephone: 202-512-1800
Fax: 202-512-2250
2. The National Technical Information Service
Springfield, VA 22161-0002
www.ntis.gov
1-800-553-6847 or, locally, 703-605-6000
A single copy of each NRC draft report for comment is
available free, to the extent of supply, upon written
request as follows:
Address: Office of the Chief Information Officer,
Reproduction and Distribution
Services Section
U.S. Nuclear Regulatory Commission
Washington, DC 20555-0001
E-mail:
[email protected]
Facsimile: 301-415-2289
Some publications in the NUREG series that are
posted at NRC's Web site address
htto://www.nrc.pov/readinq-rm/doc-collections/nuregs
are updated periodically and may differ from the last
printed version. Although references to material found
on a Web site bear the date the material was accessed,
the material available on the date cited may
subsequently be removed from the site.
Copies of industry codes and standards used in a
substantive manner in the NRC regulatory process are
maintained atThe NRC Technical Library
Two White Flint North
11545 Rockville Pike
Rockville, MD 20852-2738
These standards are available in the library for
reference use by the public. Codes and standards are
usually copyrighted and may be purchased front the
originating organization or, if they are American
National Standards, fromAmerican National Standards Institute
11 West 42'd Street
New York, NY 10036-8002
www.ansi.org
212-42-4900
Legally binding regulatory requirements are soated
only in laws; NRC regulations; licenses, including
technical specifications; or orders, not in
NUREG-series publications. The views expre ssed
in contractor-prepared publications in this series are
not necessarily those of the NRC.
The NUREG series comprises (1) technical and
administrative reports and books prepared by the
staff (NUREG-XXXX) or agency contractors
(NUREG/CR-XXXX), (2) proceedings of
conferences (NUREG/CP-XXXX), (3) reports
resulting from nternational agreements
(NUREGIIA-XXXX), (4) brochures
(NUREG/BR-XXXX), and (5) compilations of egal
decisions and orders of the Commission and Atomic
and Safety Licensing Boards and of Directors'
decisions under Section 2.206 of NRC's regulations
(NUREG-0750).
NUREG-1784
Operating Experience
Assessment - Effects of Grid
Events on Nuclear Power Plant
Performance
Manuscript Completed: December 2003
Date Published: December 2003
Prepared by
W.S. Raughley, G.F. Lanik
Division of Systems Analysis and Regulatory Effectiveness
Office of Nuclear Regulatory Research
U.S. Nuclear Regulatory Commission
Washington, DC 20555-0001
ABSTRACT
Deregulation of the electrical industry has resulted in major changes to the structure of the
industry over the past few years. Whereas before, electric utilities produced the electricity and
operated the transmission and distribution system, that is no longer the case. In many states,
the electric utilities have split into separate generating companies, and transmission and
distribution companies. Most nuclear power plant (NPP) operators no longer have control of
the transmission and distribution system operations. NPPs rely on outside entities to maintain
adequate reactive and voltage support for NPP operation. An assessment was completed by
the Office of Nuclear Regulatory Research (RES) to identify changes to grid performance
relative to NPPs which could impact safety. The assessment also provides some numerical
measures to characterize grid performance before and after deregulation - in particular, those
related to loss of offsite power (LOOP).
The information gathered' provides a baseline of grid performance to gauge the impact of
deregulation and changes in grid operation. The period 1985-1996 was considered ubefore
deregulation" and 1997-2001 after deregulation." The assessment found that major changes
related to LOOPs after deregulation compared to before include the following: (1) the
frequency of LOOP events at NPPs has decreased; (2) the average duration of LOOP events
has increased; (3) where before LOOPs occurred more or less randomly throughout the year,
for 1997-2001, most LOOP events occurred during the summer; and (4) the probability of a
LOOP as a consequence of a reactor trip has increased.
The assessment re-enforces the need for NPP licensees and NRC to understand the condition
of the grid throughout the year to assure that the risk due to potential grid conditions remains
acceptable.
1
This work was completed prior to the August 14, 2003, blackout that affected several states and Canada.
iii
CONTENTS
ABSTRACT .....................................
iii
EXECUTIVE SUMMARY ......................................
vii
FOREWORD..............................................................
xi
ABBREVIATIONS..........................................................
xii
1 INTRODUCTION ...............................................
2 BACKGROUND .....................................
2.1
2.2
2.3
2.4
Principal Design, Operating and Maintenance Criteria and Risks.
2.1.1 Principal Offsite Power System Design and Reliability Criteria.
2.1.2 Principal Risks and Regulatory Expectations.
2.1.3 Control of Risks From Running EDG Tests to The Grid.
Reactor Trips Degrade the Grid and Result in Regulatory Actions.
Nuclear Power Plant Voltages Based on Grid Electrical Parameters.
Effects of Deregulation of the Electric Power Industry
on Nuclear Power Plants
.7
1
2
2
2
3
4
5
7
3 DISCUSSION .....
................ 10
3.1
Methods for Data Collection and Risk Analyses
.
.
10
3.2
Risk Insights and General Observations ....... I .....
................. 13
3.2.1 Risk Insights ............................................ 13
17
3.2.2 General Observations .....................................
3.3
Nuclear Plant Voltages Not Always Analyzed for Grid
19
.........................
Conditions Experienced
.....................
19
Grid
Loading
and
Equipment
Out
of
Service
3.3.1
3.3.2 Grid Reactive Capability Weakened .21
23
3.3.3 Transmission System Faults May Involve Miltiple Reactor Trips
3.4
Licensees Should Contract for Adequate Voltage Support .
.24
3.5
Emergency Diesel Generator Test With Grid Degraded May Compromise
Independence
..
25
3.6
Potential Damaging Effects of Current Unbalances From Grid Disturbances . .26
3.7
Grid Transients May Degrade Scram and Anticipated Transient
Without Scram Capabilities .27
............. 27
3.8
Effects of Overfrequency on Reactor Integrity ...........
4 ASSESSMENT ..................................
28
5 REFERENCES ..................................
30
v
APPENDICES
A
B
C
D
Grid Events ...................................................
Risk Analysis ....................................................
LOOP and Scram Data ...............................................
Resolution of Comments ...............................................
. A-1
B-1
C-1
D-1
FIGURES
1
B-1
B-2
B-3
13
Risk Profile . ....................................................
Simplified Event Tree for a Reactor Trip-Consequential LOOP .....
............ B-3
...................... B-4
Simplified Event Tree for a LOOP Event Tree ........
B-7
Risk Profile ....................................................
TABLES
1
2
3
A-1
A-2
A-3
A-4
B-1
B-2
C-1
C-2
C-3
C-4
C-5
C-6
C-7
Grid Event Summary ..................................................
12
Changes in Risk After Deregulation ......................................
14
Pennsylvania, New Jersey, Maryland Interconnection
24
Base-Line Voltage Limits ..............................................
.................... A-24
Types and Number of Grid Events 1994-2001 ........
Event Summary ..................................................
A-27
Event Causal Factors ...............................................
A-40
Summary of Event Group Causal Factors .........
....................... A-41
Operating Data From LOOPs At Power Before and After Deregulation .....
...... B-5
Changes in Risk After Deregulation ..............
........................ B-8
LOOPs While at Power 1997-2001 ..............
........................ C-1
Consequential LOOPs 1985-1996 ..............
........................ C-2
Grid-Related or Initiated LOOPs While at Power 1985-1996 ......
............ C-2
Plant Related LOOPs While at Power 1985-1996 ........
................... C-3
Weather Related LOOPS While at Power 1985-1996 .......
................. C-4
Non-Initiating LOOPs While at Power 1985-1996 ........
................... C-4
Annual Scrams and Critical Reactor Years 1985-2001 ......
................. C-5
vi
EXECUTIVE SUMMARY
Deregulation of the electrical industry has resulted in major structural changes over the past
few years. Whereas before, electric utilities produced the electricity and operated the
transmission and distribution system, that is no longer the case. In many states, the electric
utilities have split into separate generating companies, and transmission and distribution
companies, thereby increasing the coordination times to operate the grid from involvement of
different companies. In addition, generating companies have daily open access to the grid and
this changes the grid power flows and voltages so as to change the grid parameters in the
nuclear power plant (NPP) design and grid operating configurations that were established
before deregulation. NPPs now rely on outside entities to maintain safety bus voltage within
limits for NPP operation. The Office of Nuclear Regulatory Research (RES) completed an
assessment that is intended to identify changes to grid performance relative to the safety
performance of NPPs. The assessment also provides some numerical measures to
characterize grid performance before and after deregulation - in particular, those related to
loss of offsite power (LOOP).
The information gathered' provides a baseline of grid performance to gauge the impact of
deregulation and changes in grid operation. 'The period 1985-1996 was considered before
deregulation" and the 1997-2001 "after deregulation." The assessment found that major
changes related to LOOPs after deregulation compared to before include the following: (1) the
frequency of LOOP events at NPPs has decreased; (2) the average duration of LOOP events
has increased - the percentage of LOOPs longer than 4 hours2 has increased substantially;
(3) where before LOOPs occurred more or less randomly throughout the year, following
deregulation, most LOOP events occurred during the summer months (May-September); and
(4) the probability of a LOOP as a consequence of a reactor trip has increased during the
summer months.
Simplified event trees were developed to assess the impact of grid changes on overall NPP
risk, and to include the impact of the LOOP as a consequence of a reactor trip. The findings
indicate: (1) the average yearly risk from LOOPs and reactor trips 'decreased, and (2) a small
number of events over the first 5 years of deregulated operation indicate that most of the risk
from LOOPs occurs during the summer months. 'Sensitivity studies indicate that the risk
reduction goals from SBO implementation have been maintained, except during summertime
operations with the emergency diesel generator (EDG) out of service or with the grid degraded.
The assessment re-enforces the need for NPP licensees 'and NRC to understand the condition
of the grid throughout the year to assure that the risk due to potential grid conditions remains
acceptable. To elaborate:
(1)
The NRC does not regulate the grid; however, the performance of offsite power is a
major factor for assessment of risk. With respect to maintaining the current levels of
safety, offsite power is especially important when considering EDG maintenance and
This work was completed prior to the August 14, 2003, blackout that affected several states and Canada.
2 Implementation of the station blackout (SBO) rule (10 CFR 50.63) has resulted in NPPs having an SBO
coping capability of at least 4 hours to ensure safety of plant equipment and allow time to restore ac power.
vii
outage activities. Consequently, NRC and licensee assessments of risk that suppc rt
EDG maintenance and outage activities should include: (a) assessment of offsite power
system reliability, (b) the potential for a consequential LOOP given a reactor trip, and (c)
the potential increase in the LOOP frequency in the summer (May to September).
Regarding (a) above, the assessment of the power system reliability and risks from plant
activities can be better managed though coordination of EDG tests with transmission
system operating conditions.
(2)
Another important aspect of the changes to the electrical grid is the impact on the
electrical analyses of NPP voltage limits and predictions of voltages following a reactor
trip and whether a reactor trip will result in a LOOP. Recent experience shows that
actual grid parameters may be worse than those assumed in previous electrical
analyses due to transmission system loading, equipment out-of-service, lower than
expected grid reactive capabilities, and lower grid operating voltage limits and acticn
levels. NPP design basis electrical analyses used to determine plant voltages should
use electrical parameters based on realistic estimates of the impact of those conditions.
(3)
With the structural and operational changes that have occurred in the industry, it is
important to have formal agreements, such as contracts between the NPP and
transmission company, in place to ensure grid operators will maintain adequate rea ctive
and voltage support. Some regional grid operating entities manage and control
operational and engineering activities in real time to maintain grid availability and
reliability. Since external factors impact the ability of licensees to manage risks and
understand the condition of the grid, some NPP licensees have implemented contractual
agreements with grid operators to provide a mechanism for maintaining secure electrical
power in the deregulated environment. Contractual arrangements should include
specific regulatory requirements or commitments; electrical performance requirements
under normal, transient, and accident conditions; communication protocols; operating
procedures and action limits; maintenance responsibilities; responsibility for station
blackout (SBO) (alternate ac) power supplies not owned by the licensee; and NPP and
grid technical parameters necessary to maintain adequate electrical supply to the NPP.
Within its proper roles and responsibilities, the NRC should communicate with the
industry about the possible need for formal agreements.
Additional insights from this study include the following:
(1)
The California Independent System Operator (CAISO), the Pennsylvania-New JerseyMaryland (PJM) Interconnection, and Callaway experiences provide an opportunity for
the industry and NRC to develop lessons to be learned. As examples, CAISO found it
needed to manage and control regional operational and engineering activities in real
time to maintain adequate reactive and voltage support to NPPs, PJM identified
numerous corrective actions for the root causes of low voltage conditions following a
1999 heat wave, and Callaway modified the plant and its grid operating protocols with
the transmission entity as a result of low voltage conditions from operating in a
deregulated environment.
(2)
While the data set is small, the number, types, and duration of LOOPs have changad
since 1997. Recent experience indicates that there are fewer LOOPs. Whereas most
viii
-of the 1985-1996 LOOPs were of short duration and plant-centered, most of the recent
LOOPs are longer and had major grid involvement from the reactor trip, severe weather
or lightning that affected the NPP switchyard and transmission lines, or NPP switchyard
equipment failures. Further, based on historical data, power restoration times following
a LOOP were generally less than 4 hours; more recent LOOPs have lasted significantly
longer. Also, recent grid events, although not directly associated with LOOPs, indicate
that grid recovery times are longer. For example, in the Northeast, it took the grid
operator (of 12 NPPs) 10 hours to resolve problems from unexpected behavior of the
grid, despite implementation of planned voltage and load management programs;
investigation found insufficient reactive capacity to quickly restore voltages. In the
Mid-West, the grid operator needed 12 hours to change regional power flows and
restore voltage to an NPP. Longer restorations for most of the events challenge the
assumptions and capabilities used in assessing plant risk from LOOPs.
(3)
LOOPs, partial LOOPs, and voltage degradations below the technical specification low
limit following or coincident with a reactor trip may indicate potential electrical
weaknesses in the grid and a need for followup to prevent more serious events.
(4)
Realistic assessment of the risk from grid events will need to consider the impact of a
grid event on multiple NPPs. For example, a 1996 transmission system disturbance
resulted in the simultaneous trip of four NPPs.
(5)
Experience indicated that transmission system operation or disturbances may cause
sustained or frequent current unbalances that result in damage to electrical equipment.
It is common practice to protect expensive or important non-safety equipment from
current unbalances. Safety equipment should also have the same level of protection.
(6)
Grid-induced reactor transients can effect scram capability. Operating experience
identified an instance where anticipated transient without scram mitigation based on
end-of-cycle recirculation pump trip logic failed to operate correctly during a
transmission system fault that produced large electrical load fluctuations.
(7)
Grid conditions which result in over-frequency conditions can have unexpected
consequences. At one plant, over-frequency conditions following a load rejection
caused speed-up of the reactor coolant pumps which increased flows that generated
forces to within a small margin of those causing uplift of the fuel rods. The
over-frequency condition was not properly accounted for by the plant protective relay
control logic.
(8)
The synergistic effects of reduced reactive grid capability on NPPs from hot weather or
multiple reactor power uprates should be evaluated to determine the impact on the
capacity and capability of the grid to maintain adequate NPP voltages.
(9)
Attention to non-safety related equipment could improve the response of an NPP to a
grid electrical transient or LOOP. The availability of non-safety related voltage
controlling equipment, such as station power transformer automatic tap changers that
control safety bus voltage levels, is important as these are assumed to be functional in
the analyses of internal voltages and by the grid controlling entity for the range of
external voltages maintained at the NPP. In addition, attention to non-safety related
ix
NPP protective setpoints may reduce the chance of a premature NPP trip during a grid
disturbance. For example, experience caused one licensee to lower RCP undervollage
and underfrequency setpoints to better coordinate with grid relay setpoints. In othe,instances, inappropriate NPP main generator voltage regulator and volts per hertz
protective relay setpoints caused unnecessary reactor trips during a grid disturbance.
x
FOREWORD
This report identifies changes to grid performance which could impact nuclear power plants
(NPP) safety. This work was completed prior to the August 14, 2003, blackout that affected
several states and Canada. The information gathered provides a baseline of grid performance
to gauge the impact of deregulation and changes in grid operation. The report provides a
comparison and assessment of loss of offsite power (LOOP) experience over two distinct
periods of time, before deregulation (1985-1996) and after deregulation (1997-2001). The
assessment found that major changes related to LOOPs after deregulation compared to before
include the following: (1)the frequency of LOOP events at NPPs has decreased; (2) the
average duration of LOOP events has increased - the percentage of LOOPs longer than
4 hours has increased substantially; (3) where before LOOPs occurred more or less randomly
throughout the year, following deregulation, most LOOP events occurred during the summer
months (May-September); and (4) the probability of a LOOP as a consequence of a reactor trip
has increased during the summer months.
The report notes important aspects of risk assessments, that support emergency diesel
generator maintenance, and outage activities should include: (a) assessment of offsite power
system reliability, (b) the potential for a consequential LOOP given a reactor trip, and (c) the
potential increase in the LOOP frequency in the summer (May to September). In addition,
changes to the electrical grid could impact previous electrical analyses of NPP voltage limits
and predictions of voltages following a reactor trip and whether a reactor trip will result in a
LOOP. Recent experience shows that actual grid parameters may not be consistent with
parameters assumed in electrical analyses due to transmission system loading, equipment outof-service, lower than expected grid reactive capabilities, and lower grid operating voltage limits
and action levels. NPP design basis electrical analyses used to determine plant voltage needs
to reflect realistic estimates of those parameters.
Best practices indicate formal agreements between the NPP and transmission company, will
help ensure that grid operators will provide reliable electrical power. Some regional grid
operating entities manage and control operational and engineering activities in real time to
maintain grid availability and reliability. Since external factors impact the ability to fully manage
risks and understand the condition of the grid, some utilities have implemented contractual
agreements with grid operators to provide a mechanism for maintaining secure electrical power
in the deregulated environment. These contractual arrangements include specific electrical
requirements, communication protocols, operating procedures and action limits, maintenance
responsibilities, station blackout (alternate ac) power supply responsibilities, and NPP and grid
technical requirements necessary to maintain adequate electrical supply'to the NPP.
This report provides the basis and a new perspective for assessing grid performance and
associated best practices. Insights from this report will be used to establish a collaborative
effort with the nuclear and electric industries to collect grid reliability data, complete a field
survey of NPPs and grid operators best practices to bridge the gap between power producers
and transmission entities, and investigate variations in grid domains that could impact NPP
offsite power performance.
Farouk Eltawila, Director
Division of Systems Analysis and Regulatory Effectiveness
Office of Nuclear Regulatory Research
xi
ABBREVIATIONS
ASP
accident sequence precursor
CAISO
CCDP
CDF
CFR
California Independent System Operator
conditional core damage probability
core damage frequency
Code of Federal Regulations
DAWG
DOE
Disturbance Analyses Working Group
Department of Energy
EDG
EOC
EPRI
emergency diesel generator
end of cycle
Electric Power Research Institute
FERC
FSAR
FTR
Federal Energy Regulatory Commission
final safety analysis report
failed to run (load)
GDC
GL
General Design Criterion
generic letter
IN
INPO
Information Notice
Institute of Nuclear Power Operations
LER
LOOP
licensee event report
loss of offsite power
MTC
MVAR
MWe
MW
MWt
moderator temperature coefficient
megavolt-ampere-reactive
megawatt electric
megawatt
megawatt thermal
NERC
NPP
NRC
North American Electric Reliability Council
nuclear power plant
Nuclear Regulatory Commission, U.S.
OOS
out of service
PCM
PJM
percent millirho
Pennsylvania, New Jersey, Maryland Interconnection
RCP
RES
RIS
RPT
reactor coolant pump
Nuclear Regulatory Research, Office of (NRC)
Regulatory Issue Summary
recirculation pump trip
xii
RY
reactor-year
SBO
station blackout
TCV
TS
turbine control valve
technical specification
VOPT
variable overpower trip
xiii
1 INTRODUCTION
Deregulation of the electrical industry has resulted in major changes to the structure of the
industry over the past few years. Whereas before, electric utilities produced the electricity and
operated the transmission and distribution system, that is no longer the case. In some states,
the electric utilities have split into separate generating companies, and transmission and
distribution companies. More companies are likely to lead to increased coordination times to
operate the grid. In addition, generating companies have daily open access to the grid and this
changes the grid power flows and voltages so as to change the grid parameters in the nuclear
power plant (NPP) design, and the grid and operating configurations that were established
before deregulation. NPPs now rely on outside entities to provide reliable electrical power for
NPP operation.
The Nuclear Regulatory Commissions' (NRC) Office of Nuclear Regulatory Research (RES)
completed the work described in this report to identify and provide an assessment of grid
events and loss of offsite power (LOOPs) at NPPs before deregulation (1985-1996) and after
deregulation (1997-2001). The objectives of the work were to use accumulated operating
experience from various sources to identify and assess: (1) the numbers, types, and causes of
these events; (2) potential risk-significant issues; (3) potential challenges to the effectiveness of
the NRC regulations; and (4) lessons learned. This assessment is intended to identify changes
to grid performance relative to NPPs that could impact safety. The assessment also provides
simplified numerical measures to characterize grid performance before and after deregulation
- in particular, those related to LOOPs. The information gathered' provides a baseline of grid
performance to gauge changes in grid operation by operating in a deregulated environment.
For the purposes of this assessment, grid events include: (1) losses of electric power from any
remaining power supplies as a result of,-or coincident with, a reactor trip; (2) reactor trips,
LOOPs, or partial LOOPs in which the first event in the sequence of events occurred in the
transmission network (i.e., the NPP switchyard or the transmission and generation system
beyond the NPP switchyard); and (3) events of interest" that provide an insight into the plant
response to a grid initiated event.
Since our focus is on aspects of grid performance, some events are defined differently here
than in other assessments - a number of the events which are defined in this assessment as
grid related LOOPs or grid initiated reactor trips based on transmission network equipment
failures, personnel errors, or dependence on grid operator for recovery, are referred to in other
event studies as plant-centered. For the purposes of this assessment a reactor trip from full
power operation is a random test of the capacity and capability of the grid, and as such a LOOP
as a consequence of a reactor trip may be a grid-related LOOP.
As an overview, Section 2 , "Background," provides basic information necessary to understand
the work. Section 3, "Discussion," provides the analyses and discussion to satisfy the
objectives of the work. The numbers, types, and causes of these events were developed from
Appendix A, "Grid Events," as explained in Section 3.1. Section 3.2 compared the risks from all
LOOP events before and after deregulation on an equal basis using Appendix B. Event Trees,"
and actual operating data which were gathered in Appendix C, "LOOP and Scram Data,
1 This work was completed prior to the August 14, 2003, blackout that affected several states and Canada.
1*
1985-2001." Sections 3.2 to 3.8 provide risk insights and lessons learned and finish with
assessments that are consolidated in Section 4, "Assessment." Appendix D, Resolution of
Comments, provides for the resolution of comments to an earlier revision of the report.
2 BACKGROUND
The NPP offsite power system is the typically "preferred source" of ac electric power for all
conditions, including accident and post accident, and is often referred to as the grid. The safety
function of the offsite power system is to provide power to ac safety loads required to shut down
the NPP, including loads in the reactor core decay heat removal system that are required ':o
preserve the integrity of the reactor core and containment following a reactor trip. For the
purposes of this assessment, the grid includes the switchyard or substation at the NPP, the
offsite generating and transmission systems, and the offsite loads. Redundant onsite ac
emergency power supplies, usually emergency diesel generators (EDGs), automatically provide
power to the safety buses following a LOOP.
2.1
Principal Design, Operating and Maintenance Criteria and Risks
The NRC has no jurisdiction over the grid. However, NRC regulations and NPP Technical
Specifications (TS) provide controls over the licensing bases, design criteria, NPP activities,
and risks relative to the grid as discussed below.
2.1.1
Principal Offsite Power System Design and Reliability Criteria
The principal design criteria for the licensing basis of the offsite electric power system are set
forth in Title 10 Code of Federal Regulations (CFR) Part 50, "Domestic Licensing of Production
and Utilization Facilities," Appendix A, "General Design Criteria for Nuclear Power Plants"
(Ref. 1).
General Design Criterion (GDC) 17, Electric power systems," of Appendix A states in part, that
An onsite electric power system and an offsite electric power system shall be provided
... The safety function for each system (assuming the other system is not functioning)
shall be to provide sufficient capacity and capability ...
Provisions ... to minimize the probability of losing electric power from any of the
remaining supplies as result of, or coincident with, the loss of power generated
by the nuclear power unit, the loss of a power from the transmission network, or
the loss of power from the onsite electric power supplies.
Common capacity and capability terms are power, voltage, and frequency. While a detailed
electrical engineering discussion of these terms is beyond the scope of this report, it suffices to
understand that power (mega-volt-amperes or MVA) has two components, real and reactive,
measured in megawatts (MW) and megavars (MVAR), respectively. The real power component
supplies resistive loads such as lights and heaters. The real power component flow between
two points depends primarily on the relative voltage phase angles. The reactive power
2
component supplies inductive loads such as motors. The reactive power component flow is a
direct function of the difference in the magnitude of the voltage at these points.
The GDC 17 requirements are intended to ensure that the NPP connects to a sufficiently robust
and reliable grid and are part of the licensing bases. The GDC 17 provision to minimize the
probability of losing electric power is a common grid design practice for any generating plant.
The industry uses the same measures as GDC 17 to define grid reliability. The North American
Electric Reliability Council (NERC), an industry organization that promotes and assesses grid
reliability, defines grid reliability in terms of the "adequacy" of the generation system and the
"security" of the transmission system. The adequacy of the generation system is measured by
the amount of reserve power available to provide uninterruptible power. Grid operating entities
maintain spinning reserves" synchronized to the grid for immediate use. Voltage reductions
and interrupting loads (rolling blackouts) also'help to maintain minimum reserves in an
emergency. The security of the transmission'system is defined in terms of the ability of the
system to'withstand sudden disturbances, such a'reactor trip or transmission line fault. Grid
operating entities typically perform analyses to determine the requirements and limits that are
used in the operation of the system to ensure adequate levels of power, voltage, and frequency
following a disturbance. Spinning reserves, the results of analyses, as well as voltage and load
management programs are important factors for grid operators to maintain system stability,
adequate NPP voltages and frequencies, and recover from grid events in a timely manner.
In addition, the NRC Standard TS (Ref. 2), which are typical of NPP TS, provide for verification
of the availability of the offsite power supplies every 7 days. The TS imposes limiting conditions
of operation including shutdown of the reactor should offsite power not be restored in a timely
manner, typically in times up to 72 hours for loss of individual offsite power supplies and shorter
times for loss of multiple offsite power supplies. The NRC TS states that the operability of ac
electrical power supply considers the capacity and capability of the remaining sources,
reasonable time for repairs, and the low probability of a design basis accident occurring in this
period. Continued operation for 72 hours generally requires, consistent with Regulatory
Guide 1.93, Availability of Electric Power Sources," 1974, that licensees assess that system
stability and reserves are such that a single failure (including a reactor trip) would not cause a
LOOP.
2.1.2
Principal Risks and Regulatory Expectations
10 CFR 50.63, "Loss of All Alternating Current Power," is commonly referred to as "the station
blackout rule." A station blackout (SBO) is defined in 10 CFR 50.2 as the "complete loss of
electric power to the essential and nonessential electric switchgear buses in an NPP
(i.e., a LOOP concurrent with a turbine trip'and unavailability of the emergency ac power
system)." The SBO rule requires that NPPs be'capable of withstanding an SBO by maintaining
core cooling for a specified duration (coping time) and recover from the SBO event. The
principal parts of an SBO accident sequence are: (1) the initiating LOOP - the frequency of a
LOOP, (2) the loss of onsite power - the unreliability of the onsite ac emergency power
supplies and common cause failure unreliability, (3) recovery - the likelihood that ac power will
be restored before the core is damaged, and (4) core damage probability - the sequences that
result in core damage from the failure to recover ac power and consequently, the failure of
decay heat removal or support systems necessary to safely shutdown. Core cooling failures, or
loss of reactor core cooling integrity can occur in 1 to 2 hours. Failures can also occur in 4 to
8 or more hours from support system failures (e.g., batteries, compressed air, heating,
3
ventilation, and air conditioning) or design limitations (e.g., high suppression pool
temperatures).
The SBO rule was based on NUREG-1032, Evaluation of Station Blackout Accidents at
Nuclear Power Plants," June 1988 (Ref. 3). According to NUREG-1 032, the estimated range
for the frequency of core damage as a result of an SBO accident is 1E-6 to 1E-4 per
reactor-year (RY). NUREG-1032 focused on the reliability of the onsite power system based on
the judgement that it would be easier to implement modifications, if required, on the onsite
power system rather than the grid. NUREG-1032 stated that offsite power system reliability
was dependent on a number of factors, such as repair and restoration capability, that were
difficult to analyze and control.
A RES report, "Regulatory Effectiveness of the Station Blackout Rule," August 15, 2000
(Ref. 4), assessed whether or not the SBO rule achieved the desired outcome. The RES report
compared the risk reduction expectations from SBO rule implementation as established in
NUREG-1 109, "Regulatory/Backfit Analysis for the Resolution of the Unresolved Safety ls3ue
A-44, "Station Blackout," June 1988, to the estimated risks from an SBO as documented in the
licensee probabilistic risk assessments of that era. The RES report shows that SBO rule
implementation resulted in a risk reduction in the mean SBO core damage frequency (CDIF) of
3.2E-05/RY, slightly better than the 2.6E-05/RY expected.
NUREG-1 032 concludes that "the capability to restore offsite power in a timely manner (le3s
than 8 hours) can have a significant effect on accident consequences." NUREG-1 032 stu Jied
LOOP event frequency and duration data in three categories (i.e., plant-centered, weathelrelated, and grid-related events) and found the median recovery times to be 18, 210, and
36 minutes respectively, based on data from 1968 through 1985. NUREG-1032 found the
overall median recovery time to be 36 minutes. NUREG-1032 data shows that prior to SBO
rule implementation, of the 59 LOOPs at power which were identified, only four (7 percent) were
more than 4 hours; one was a grid event, three were weather-related events, and the longest
plant-related event was 165 minutes. NUREG-1032 expected "enhanced recovery times" for
grid-related and severe weather LOOPs based on the availability of plant recovery procedures
and at least one source of ac power.
NUREG-5496, "Evaluation of Loss of Offsite Power Events at Nuclear Power Plants:
1980-1996," June 1998 (Ref. 5), found the median recovery times to be 20, 204, and
140.5 minutes for plant-centered, weather-related, and grid-related events. NUREG-5496
indicates the overall median recovery time for LOOPs at power is 60 minutes. More
specifically, NUREG-5496 identified six grid-related LOOPs from 1986 to 1989 with a median
recovery time of 140 minutes and no grid-related LOOPs from 1990 to 1996. NUREG-5496
found that up to 1996, the number of grid-related LOOPs was quite low and the recovery times
were longer but the data set was small. The NUREG-5496 executive summary concluded that
the recovery times for SBO type events were well below the minimum SBO coping time.
2.1.3 Control of Risks From Running EDG Tests to The Grid
EDGs are periodically tested (monthly) to the grid one at a time, for 60 minutes, and
approximately every 18 months for 24 hours, as specified in the TS. NRC standard TS
surveillance requirements state that testing one EDG at a time avoids common-cause failures
that might result from offsite circuit or grid perturbations. The 60 minute run stabilizes engine
4
temperatures, while minimizing the time the EDG is connected to the offsite source. The
Standard TS notes that the 24-hour test is not performed with the reactor at power but may be
performed to reestablish operability provided an assessment determines the safety of the plant
is maintained or enhanced. The TS bases state the assessment shall consider potential
outcomes and transients associated with a perturbation of the offsite or onsite system when tied
together and measure these risks against the avoided risk of a plant shutdown and startup to
determine that plant safety is maintained or enhanced when the surveillance is performed while
at power.
10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power
plants," commonly referred to as the "maintenance rule," requires licensees to assess and
manage risk when performing maintenance activities as follows:
(a)(4) Before performing maintenance activities (including but not limited to surveillance,
post-maintenance testing, and corrective and preventative maintenance), the licensee
shall assess and manage the increase in the risk that may result from the proposed
maintenance activities. The scope of the assessment may be limited to structures,
systems, and components that a risk-informed evaluation process has shown to be
significant to public health and safety..
NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at
Nuclear Power Plants, May 2000 (Ref. 6), provides guidance on implementing the provisions of
10 CFR 50.65 (a)(4) by endorsing Section 11 'to NUMARC 93-01, "Nuclear Energy Institute
Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants,
February 22, 2000 (Ref. 7). Section 11 to NUMARC 93-01 addresses offsite power in several
areas. For example, Section 11.3.2.8 states "Emergent conditions may result in the need for
action prior to conduct of the assessment, or could change the conditions of a previously
performed assessment. Examples include ... significant changes in external conditions
(weather, offsite power availability)."
2.2
Reactor Trips Degrade the Grid and Result in Regulatory Actions
All reactor trips from full power operation are a random test of the capacity and capability of the
grid and as such are potentially grid-related events. Under GDC 17 the grid should have
sufficient capacity and capability to allow the NPP to pass this test. When a reactor trips, the
voltage in the vicinity of the NPP drops from the loss of NPP main generator reactive power
supply. The voltage normally recovers quickly as "spinning reserves' and other reactive power
supplies immediately supply power: LOOPs, partial LOOPs, and voltage degradations below
the plant specific low limit following or coincident with a reactor trip are evidence of potential
electrical weaknesses in the grid.
The NRC took generic actions consistent with GDC 17 after two reactor trips in summer months
resulted in degraded NPP voltages below the levels needed to respond to a design basis event.
One of the events involved two occurrences, 2 weeks apart, in July 1976 at an NPP in the
Northeast. In the first occurrence, when the reactor tripped the 345 kV voltage dropped
approximately 5 percent from 352 kV to 333 kV for 1 hour. This system voltage degradation
along with the voltage drops through the NPP transformers, reduced the voltage at safetyrelated equipment to levels that were insufficient to operate the equipment. In addition, certain
non-safety related equipment did not start due to blown fuses. Corrective action included
5
raising undervoltage relays setpoints to assure the plant would be separated from a degraJed
grid before the voltage dropped to a point where equipment operability could no longer be
assured.
A few weeks later, the inrush current from the start of a non-safety 1500 horsepower motcr
resulted in low voltage and the EDGs automatically started and loaded. However, during
automatic load sequencing the inrush current from safety motor starts caused the bus voltage
to drop below the new undervoltage setpoints. The conditional core damage probability
(CCDP) for this event was 1.4E-02 due to the lack of plant procedures to respond to the event.
This event resulted in an NRC generic letter (GL) (not numbered at the time) dated June 2,
1977 (referenced in Ref. 8), requiring licensees to add degraded voltage relays to trip the offsite
power supply to safety buses and start the emergency onsite power supplies at or above te
calculated minimum voltage levels needed to withstand a design basis event.
The second reactor trip occurred in September 1978 at a dual unit NPP. When the reactor
tripped, the transfer of the station loads tripped a transmission system auto-transformer that
was already feeding the other NPP's station power transformer. The loads from both NPPs
transferred to, and overloaded, a "back-up" NPP transformer. Power was restored in
approximately 88 minutes and the CCDP was less than 1.OE-06. The licensee's review of the
event found that degraded voltage conditions would result at the safety buses following a
design basis event and that the safety loads might not transfer to the EDGs. After this event,
the NRC issued GL 79-36, Adequacy of Station Electric Distribution System Voltages," August
8, 1979 (Ref. 8), which expanded the NRC review of the adequacy of the electric power system
to include the results of plant-specific analysis using NRC guidelines for voltage drop
calculations.
The GL 79-39 guidelines for voltage drop calculations require licensees to consider a reaa:or
trip and the minimum expected" and maximum expected" grid voltage as follows:
Separate analyses assuming the power source to the safety buses is . . . (c) other
available connections to the offsite network one by one assuming the need for electric
power is initiated by (1) an anticipated transient (e.g., unit trip) or (2) an accident,
whichever presents the largest load demand situation.
The voltage at the terminals of the safety loads should be calculated based on . . . :he
assumption that grid voltage is at the minimum expected value" . . . and selected
based on the lowest of the offsite circuit, (b) the minimum voltage expected at the
connection to the offsite circuit due to contingency plans which may result in reduced
voltage from the grid, or (c) the minimum predicted grid voltage from grid stability
analysis (e.g., load flow studies).
Provide assurance the actions to assure adequate voltage levels for safety loads do not
result in excessive voltage, assuming the maximum expected value of voltage at th a
connection of the offsite circuit ...
....requests licensees to state planned actions including any limiting conditions of
operation for TS in response to experiencing voltages below analytical values.
6
;'."'
2.3
1,i ' 't
Nuclear Power Plant Voltages Based on Grid Electrical Parameters
The North American electric power supply grid consists of four nearly independent large major
areas that are interconnected. Approximately 160 control centers perform the load dispatching
and switching operations. Current flows freely within each interbonrhected system according to
the laws of electricity. Since the capacity and capability of the power system cannot be
measured or tested except when challenged, grid operating entities typically perform analyses
to determine the requirements and limits that are used in the operation of the system to ensure
adequate levels of power, voltage, and frequency following a disturbance. The grid operating
or transmission entity analyzes this system for stability, short circuits, load flows, and voltages
to ensure that the grid security is maintained.- Typically, thousands of grid operating
configurations are analyzed, assuming numerous initial conditions and contingencies, such as
the availability of the generators, sudden loss of the large generators or loads, the minimum
and peak transmission system loading, equipment out of service (OS), and faults.
The results of the grid analyses are typically summarized for the NPP in terms of the minimum
and maximum expected voltages and impedances at the high-voltage terminals of the NPP
power transformers. The NPP uses these parameters to calculate whether NPP internal
voltages are within equipment ratings and the minimum voltages using the GL 79-36 guidelines.
Licensees periodically revise these analyses with updated external voltages and impedances
from the grid operating entity. If the NPP internal voltages are not adequate (i.e., expecting that
a unit trip or other condition would result in operating voltage too close to the degraded voltage
relay and alarm setpoint), the licensees and grid operating entities may adjust their systems
(e.g., move NPP or grid transformer voltage taps) or establish compensatory measures
(e.g., procedure revisions) to avoid potentially adverse conditions or configurations. In some
cases, the NPP or the grid operating entity may need to add equipment such as a transformer
with an automatic load tap changer (LTC) or capacitors or other reactive supply.
2.4
Effects of Deregulation of the Electric Power Industry on Nuclear Power Plants
In 1992, the National Energy Policy Act encouraged competition in the electric power industry.
The National Energy Policy Act requires, in part, open generator access to the transmission
system and statutory reforms to encourage the formation of wholesale generators. The electric
industry began deregulating after the April 1996 issuance of Federal Energy Regulatory
Commission (FERC) Order 888, Promoting Wholesale Competition Through Open Access
Non-discriminatory Transmission Services by Public Utilities, Recovery of Stranded Costs by
Public Utilities and Transmitting Utilities," which requires that utility and non-utility generators
have open access to the electric power transmission system.
Prior to economic deregulation of the electrical system, NRC licensees were both electrical
generators and transmission system operators. With economic deregulation, NRC licensees no
longer control the transmission system
typically, generation, and transmission and
distribution are separate corporations, or independent subsidiaries or affiliates of the same
corporation. Wholesale generators resulted mostly from state legislation that removed the
generators from the regulated rate base so as to allow them to compete for the sale of power in
an open market. Utilities also divested the generating assets; typically the switchyard remained
part of the transmission company. As a result of these changes there are more entities
involved in grid recovery that must be coordinated following any disturbance. A detailed stateby-state status is available on a Department of Energy (DOE) Web site and shows about
7
50 percent of the state utility regulatory commissions have (or plan to) deregulate, and
50 percent have no plans to deregulate or have put deregulation on hold.
Initial licensing of NPPs included analyses of electrical system performance with certain
contingencies to assure reliable offsite power. Open access transmission generally result. in
changes to the grid design and operation that could challenge operating limits and grid
reliability. Predicting the voltages and current paths requires analyses of the conditions being
experienced and the original NPP assumptions about the grid and associated analyses may no
longer be valid. The power market results in power transactions and transmission of electricity
over longer distances. Grid operating entities and NPPs not involved in the power transaction
may see their operation affected by unexpected power flows. Regardless of their restructuring
status or participation in the power market, all states and NPPs are exposed to design and
operating challenges from the revised power flows due to open transmission line access.
Deregulation is of interest to the NRC. The appendices of NRC, "Strategic Plan, Fiscal Year
2000 - Fiscal Year 2005," October 4, 2000 (Ref. 9), note that one of the major external factors
that could significantly affect achievement of Strategic or Performance Goals is the ongoirg
economic deregulation and restructuring of the electric power industry. The NRC has not
asked its licensees to analyze electrical system performance under the current conditions.
However, SECY-01-0044, Status of Staff Efforts Regarding Possible Effects of Nuclear
Industry Consolidation on NRC Oversight," March 16, 2001 (Ref. 10), recommends in the area
of grid stability and reliability issues that the staff monitor the developments unfolding in
different parts of the country and continue the current efforts to assimilate information.
A RES study, "The Effects of Deregulation of the Electric Power Industry on The Nuclear Plant
Offsite Power System: An Evaluation," June 30, 1999 (Ref. 11), was the basis for the
information in SECY-99-129, "Effects of Electric Power Industry Deregulation on Electric Grid
Reliability and Reactor Safety," May 1999 (Ref. 12), in response to Commissioners' questions.
The RES study was based on NPP operating experience, the staff's review of NERC reliability
forecasts, visits to 17 grid control entities, and the actions of two licensees with the California
Independent System Operator (CAISO). The RES study and SECY-99-129 identified the
following potential impacts of deregulation of the electric industry on grid reliability that are
relevant to this assessment:
*
The risk from the potential grid unreliability due to deregulation is likely to be minirral,
although individual plants might have an increase in the CDF due to deregulation cf as
much as 1.5E-05/RY.
*
The assumptions about both grid design and operating configurations that ensure
correct voltages on both the grid and at NPPs typically date from before the electric
power industry was deregulated. Failure to analyze and reconfigure the grid under
changing conditions could result in abnormal voltages or frequencies at the NPPs.
Deregulation may result in unanalyzed grid operating conditions from open access to
the transmission system; these conditions change the current flows and voltages
throughout the grid according to fundamental (Kirchoff's) laws of electricity. Today,
more blocks of power are being transmitted over greater distances; and grid operating
entities not involved in the power transaction may see their operation affected by
8
unexpected power flows. Predicting the amount and path of the current and power and
the voltage throughout the grid requires analyses.
The duration of a LOOP or an SBO may increase. Changes in ownership and control of
generation and transmission and distribution facilities add to the number of entities that
must be coordinated and is likely to increase recovery times following a grid disturbance.
The NRC issued Information Notice (IN) 98-07, "Offsite Power Reliability Challenges From
Industry Deregulation," February 27, 1998 (Ref. 13), to alert licensees to the potential adverse
effects of deregulation of the electric power industry on the reliability of the off site power
source. The NRC also issued IN-2000-06: Offsite Power Voltage Inadequacies," March 27,
2000 (Ref. 14), to inform licensees of events that caused concerns about the voltage adequacy
of offsite power sources, especially in case of NPP trips.
At an industry/NRC meeting on May 18, 2000 (Ref. 15), the industry discussed the initiatives of
Pennsylvania, New Jersey, Maryland (PJM) Nuclear Owners/Operators (grid operator for
12 NPPs), CAISO, (the grid operator for 8 NPPs), and the Institute of Nuclear Power
Operations (INPO) to help maintain GDC 17, the SBO rule, and TS compliance in a deregulated
environment. The industry initiatives include a plant-by-plant review to ensure each NPP has
established appropriate interface with the grid operator, verified procedural adequacy for a
LOOP or degraded grid, verified responsibility for NPP and switchyard high voltage equipment
maintenance, confirmed the validity of grid reliability and design assumptions and the degraded
voltage trip settings, and trained operators; these actions were detailed in a letter from the
Nuclear Energy Institute (NEI) to the NRC on June 26, 2000, "Electric Grid Voltage Adequacy"
(Ref. 16). A followup meeting was held on October 27, 2000 (Ref. 17), to discuss the status of
NRC and industry grid reliability activities including the Electric Power Research Institute (EPRI)
Power Delivery Initiative for developing tools to enhance grid reliability. The meeting resulted in
actions to prepare for an industry uGrid Reliability Workshop" that took place in April 2001.
The NRC issued Regulatory Issue Summary (RIS) 2000-24, "Concerns About Offsite Power
Voltage," December 21, 2000 (Ref. 18), to inform addressees of concerns about grid reliability
challenges as a result of industry deregulation, potential voltage inadequacies of offsite power
sources, and actions the industry had committed to address this issue. The RIS also stated
that the NRC is continuing to work with the nuclear power industry to address this matter and
acknowledged that the Nuclear Energy Institute would take the following steps as an industry
initiative: (1) provide guidance to utilities on the need for, and acceptable techniques available
to ensure, adequate post-trip voltages; (2) establish provisions to log and evaluate unplanned
post-trip switchyard voltages to help verify and validate that the intent of Item 1 is met; and
(3) determine plant-specific risks of degraded voltage and double sequencing scenarios.
The NRC is periodically reviewing the status of industry initiatives under RIS-2000-24. The
industry and the NRC met on March 15, 2002 (Ref. 19), to discuss the status of industry, INPO,
EPRI, CASIO, and PJM activities. The industry concluded that their initiatives verify that
barriers are in place to ensure NPPs are protected from a degraded grid; however, the details
of plant-specific results are not available to the NRC.
9.
3 DISCUSSION
For purposes of this work some events were classified differently than in other assessmen:s. A
number of events that are defined in this assessment as grid related LOOPs are referred t in
other event studies as plant-centered as discussed below.
The executive summary of NUREG-5496, which estimates the LOOP frequency and duration
based on operating experience from 1980-1996 states " . . . For this study, the event was
considered an initiating event if the LOOP caused the reactor to trip or if both the LOOP arid the
reactor trip were part of the same plant transient, resulting from the same root cause. It was
not an initiating event if no reactor trip occurred, or the cause of the reactor trip did not directly
cause the LOOP event, but the reactor trip subsequently caused the LOOP event. All events
included in this study are LOOP events, but only the initiating events were used in the
frequency analysis."
Consider the following example. An event initiated by a turbine trip which resulted in a LOOP
would be considered a plant-centered event in most instances. For our purposes, this event
was classified as grid related if the plant disconnected from the grid following the turbine trip
and the grid voltage decreased because of the loss of the plant's own generating capacity or
other reasons attributed to the grid. One of the goals of GDC 17 is to assure that a plant tip
will not result in a LOOP. Reactor trips are random tests of the capacity and capability of the
grid. If due to lack of capacity or capability to withstand a sudden disturbance, the grid is in a
condition such that the lost generation due to the NPP trip causes conditions which lead to a
LOOP, our interpretation is that the LOOP is grid related. For purposes of this assessment, the
initiating event may be a turbine trip, but the root cause of the LOOP is the degraded condition
of the grid.
This distinction may be important from a risk perspective. The typical risk analysis considers a
reactor trip and a LOOP to be independent initiating events - the probability of a LOOP
initiating event is not impacted by the reactor trip. However, if the grid were in a condition such
that a loss of generation leads to degraded voltage and a consequential LOOP, the risk impact
of a reactor trip would increase.
Consider another example. Most risk assessments are performed for individual NPPs wit[
limited consideration of the impact at other NPPs. Thus, it is generally assumed that a reactor
trip will not lead to a LOOP at a different NPP. However, if grid conditions were such that loss
of generating capacity from an NPP trip leads to degraded voltage and a LOOP at another site
or plant, the LOOP is considered to be grid related. Again, the risk implications of a single
reactor trip would be greater, particularly if several units were affected.
3.1
Methods for Data Collection and Risk Analyses
For the purposes of this assessment, before deregulation was assumed to be 1985-1996 and
after deregulation was assumed to be 1997-2001. As 1997 was the first full year of NPP
operation with the grid deregulated, it was selected as the starting point for deregulation; in
April 1996, FERC Order 888 required that generators have open access to the transmission
system.
10
To be consistent with other NRC assessments, this assessment considered an event to be a
LOOP when all available EDGs started and loaded. A partial LOOP was indicated by the start
and loading of one or more, but not all the EDGs. Partial LOOPs are generally not risk
significant unless complications set-in; however, they helped to identify potential NPP
sensitivities to a grid-related event.
For the purposes of this study a line of demarcation was drawn between the plant and the grid
at the NPP main and station power transformer high-voltage terminals. The grid was defined to
include: (a) the high-voltage switchyard or substation nearest the NPP which is typically under
the control of the transmission organization, (b) the transmission and generation system beyond
the switchyard or substation, and (c) the protective relaying and control circuits of the
switchyard and transmission system which are often located inside the NPP. The boundary
between the NPP and the grid was based on typical organizational responsibility for equipment
design, maintenance, and operational control. In a deregulated environment this boundary is
typically the boundary between the regulated transmission system company and the
deregulated nuclear generating company.
Appendix A provides summaries of grid events that affected NPP performance from 1994
through 2001. Although deregulation did not start until 1997, RES selected 1994 as a starting
point for the collection of events; RES was aware of at least one grid entity that used
1994-1996 grid events that affected its NPPs, in part, to obtain the lessons learned for its
future operation in a deregulated environment, so it was judged RES should do the same. The
events were identified and summarized from licensee event reports (LERs) in the NRC
Sequence Coding and Search System, NRC inspection reports,- NRC preliminary notification
(PNO) reports, NERC Disturbance Analysis Working Group (DAWG) reports, and CAISO and
PJM reports, which are discussed below. The LER, PNO, and DAWG event dates were crossreferenced to identify the events affecting multiple NPPs. It is emphasized the CAISO and PJM
reports were used not to be critical, but to gain insights; these entities are proactive with
comprehensive programs and actions for operating large, robust grids in a deregulated
environment.
The DAWG reports helped identify when the NPP event was part of a larger grid disturbance
when this was not evident from the LER. The NERC DAWG analyzes a subset of the grid
events reported to the DOE under 10 CFR, Chapter II, Section 205.351, "Report of Major
Electric Utility System Emergencies," "Reporting Requirements" (Ref. 20). Section 205.351
requires electric utilities or other entities engaged in the generation, transmission, or distribution
of electric energy for delivery or sale to the public to report to DOE certain losses of system
"firm" loads, voltage reductions or public appeals, vulnerabilities that could impact system
reliability, and fuel supply limitations. Some of the DOE events that involve the transmission
system are of interest for this report. The DOE events and NERC DAWG reports are available
on their Web sites.
The Appendix A events were defined and grouped as follows:
*
R events are losses of electric power from any remaining power supplies as a result of,
or coincident with, a reactor trip at power. Losses of electric power with a reactor trip
include any LOOPs, partial LOOPs, or voltage degradations below the plant specific low
limit.
11
I
*
S events are reactor trips where the first event in the sequence of events leading to the
reactor trip was in the switchyard or substation nearest the plant.
*
T events are reactor trips where the first event in the sequence of events leading to the
reactor trip was in the transmission system beyond the switchyard or substation nearest
the plant.
*
L events are LOOPs where the first event in the sequence of events leading to the
LOOP was in the switchyard or transmission network. LOOPs at zero power are
indicated by a zero suffix.
*
PL events are partial LOOPS where the first event in the sequence of events leadir g to
the partial LOOP was in the switchyard or transmission network.
*
I events are events of interest that provide insights into the plant response to a
switchyard or transmission network-initiated event, but did not involve a unit trip, LOOP,
or partial LOOP.
The S and T events described in Appendix A are reactor trips having major switchyard or
transmission network involvement and were not used in the risk analyses since they did not
result in a LOOP. Past NRC studies typically viewed S and T as plant centered events due to
the major role the plant played in the event, (e.g., turbine trips).
Table 1 Grid Event Summary," gives the numbers, types, and dominant causes of the reactor
events from 1994 to 2001 based on detailed information in Appendix A, Tables A-1 and A-4.
The R and L event groups LOOPs that are potentially risk significant are analyzed in
Section 3.2 and discussed in Section 3.3.
Table 1 - Grid Event Summary
Event group
94
95
R
0
0
2
S
4
7
T
4
4
96| 97
98
99
3
1
3
1
2
2
2
2
4
7
3
2
power
| 00
01
1
PL
3
1
Total
12
10
11
11
Total
10
3 LOOPs, 6 partial LOOPs, &
one voltage degradation fom
plant/grid electrical weaknesses
2
25
Grid equipment malfunctic ns
1
21
Grid equipment malfunctic ns
1
Grid equipment malfunctic ns
1
1
0 power
Dominant causes
Number of reactor events per year (1994-2001)
1
1
4
Human error
2
1
2
9
Grid equipment malfuncticns
6
7
10
70
Grid equipment malfuncticns
12
3
3.2
Risk Insights and General Observations
Section 3.2.1 provides risk insights from the LOOP data. Simplified event trees were developed
in Appendix B, "Risk Analyses," for the purposes of estimating and comparing the average
industry CDF from an SBO before deregulation (1985-1996) and after deregulation
(1997-2001) using actual operating data from Appendix C,"LOOP and Scram Data
1985-2001." Appendix B explains the risk methodology. Appendix C tables identify all LOOPs
from 1985-2001. Appendix C, "Table C-1" shows the LOOPs from 1997-2001. Eight of the
LOOPs in Appendix C were accompanied by a reactor trip and used to assess the risk after
deregulation; the risk from LOOPs not involving a reactor trip were assumed to be negligible.
Section 3.2.2 provides general observations from all of the data.
3.2.1
Risk Insights
The results of the Appendix B assessment of the risk are summarized in Table 2, "Changes In
Risk After Deregulation," and Figure 1,"Risk Profile. Table 2 shows the results in terms of a
"delta CDF that was obtained by subtracting the CDF "BEFORE" deregulation from the CDF
for the particular case being analyzed. Figure 1, shows the CDF/RY "Before" deregulation and
the CDF/RY for the particular case being analyzed. The before deregulation cases establish
baselines to evaluate changes after deregulation. The average risk reduction "delta CDFP from
SBO implementation was estimated to be 3.2E-05/RY (Ref. 21). In Table 2, a negative "delta
CDF" indicates decreased risk since deregulation and the risk reduction goals from SBO rule
implementation have been maintained; and a positive "delta CDF" indicates an increased risk
since deregulation and that a portion of the risk reduction from SBO rule implementation has
been offset. Table 2 also summarizes the change in the "delta CDF in terms of key data (the
number of reactor trips per RY; the
number of LOOPs/RY; the
Risk Profile
P(LOOP/RT), and the LOOPs
more than 4 hours as a
X
percentage and as a number per
Before and After Deregulation
RY).
° 1.OOE-03
0
U
Appendix B, Table B-1 shows the
a
key summer data for 1985-1996.
a) 1.OOE-04
Typical assessments of the risks
from an SBO use yearly averages
to calculate risk and do not
consider that the key parameters
-
a.
:
- -
i
-
affecting risk are different in the
D 1.00E-06
-
summer. Also, those
assessments do not account for
a)
both in the summer. This
assessment noted that seven of
E
0
'O
-
-
-
1.OOE-07
-
a)
as measured by P(LOOP/RT),
VI
O)
1I.00E-05
long outage times on EDGs or for
potential degraded grid conditions
P 3.E0&05
14&y=
C
IL
E-i--1--+--+
--
i -
-
--.
the eight LOOPs (87 percent)
involving a reactor trip since 1997
DG/Ave
--
30ay
E
Figure 1 - Risk Profile
13
X
Jan Mar May Jul Sep Nov Jan
Before
After
summer
EDGWC
occurred in the summer - May to September - in contrast to 23 of 54 (44 percent) LOOPs in
the summers of 1985-1996. Prior to deregulation, there was only a small difference in the
likelihood of a LOOP between the summer and the rest of the year. Thus the base case does
not make a difference between the summer and the year round.
Table 2 Changes in Risk After Deregulation
Observation
Baseline Change
-Delta CD-IRY
BEFORE
deregulation
1985-1996
Risk reduction from SBO rule 3.2E-05IRY
-Reactor trips/RY = 3.4
-LOOPs/RY = 0.05
-Probability (LOOP/reactor trip) = 0.002
-Percent LOOPs >4hours =17%
-(LOOPs > 4hours)/RY = 0.0074
0
AFTER
deregulation
1997-2001
Risk reduction from SBO rule implementation maintained.
CDF decreased below baseline due to offsetting changes:
-Reactor trips/RY =1.0
-LOOPs/RY = 0.014
-Probability(LOOP/reactor trip) = 0.0045
-Percent of LOOPs > 4 hours = 67%
-(LOOPs > 4 hours)/RY = 0.011
-O.9E-C 5
SUMMER
After deregulation
1997-2001
Risk reduction from SBO rule implementation maintained.
CDF decreased below baseline due to offsetting changes:
-Reactor trps/RY = 1.1
-LOOPs/RY = 0.021
-P(LOOP/reactor trip) = 0.01
-Percent LOOPs > 4 hours = 67%
-(LOOPs > 4 hours)/RY = 0.027
-0.5E-05
SUMMER
SENSITIVITY
1997-2001
Risk reduction from SBO rule implementation partially or fully offset:
-EDG out-of-service for 14 days with a 0.01 chance of a degraded grid
-Increase time grid degraded to 30 days (based on experience)
-EDG out-of-service for 14 days with the grid degraded
0.8E-05
1.1E-05
7.7E-0
In general, comparison data before and after deregulation shows significant changes in the key
data related to summer time LOOPs: the frequency of LOOP events at NPPs has decreased,
the average duration of LOOP events has increased, and P(LOOP/RT) has increased. Te net
effect of these changes is that the risk reduction goals from SBO rule implementation have
been maintained, except during summer time operations with EDG OOS or with the grid
degraded. The discussion below provides a detailed comparison.
Table 2 indicates a negative "delta CDF" "AFTER" deregulation indicating that
deregulation has not eroded the risk reduction from SBO rule implementation.
Comparison of the key factors in Table 2 before and after deregulation help to explain
the decrease in the risk (i.e., the decreases in the number of reactor trips/RY and
number of LOOPs/RY have more than offset the increases in percentage of LOOF's
more than 4 hours and probability of a LOOP given a reactor trip). P(LOOP/RT) is
0.0045 (as compared to 0.002 before deregulation) and corresponds to the grid bE ing in
this condition approximately 40 hours per year. Figure 1 shows the CDF/RY "AfteI'
deregulation (1997-2001) have decreased below the risk "Before."
14
Table 2 indicates that the "delta CDF' during the SUMMER" is negative indicating that
deregulation has not eroded the risk reduction from SBO rule implementation.
Comparison of the key factors in Table 2 before and after deregulation help to explain
the decrease in the risk (i.e., when averaged over the summer months [5/12's of the
each year from 1997-2001]) the decreases in the number of reactor trips/RY and
number of LOOPs/RY have more than offset the increases in the percentage of LOOPs
more than 4 hours and the probability of a LOOP given a reactor trip. P(LOOP/RT) is
0.01 and corresponds to the grid being in this condition approximately 88 hours per
year, all during the summer months (Appendix B, Table B-1 shows P(LOOP/RT) was
0.0015 during the summers of 1985-1996). Figure 1 shows the CDF/RY for the
uSummer" after deregulation peaks from May to September, 1997-2001, slightly below
that uBefore" deregulation. The peak reflects that 1997-2001 the summer data has
been averaged over 5/12ths of the year rather than the entire year.
SUMMER SENSITIVITY studies performed to gauge the potential changes by averaging
the data over the summer for plant operations assuming (1) an EDG out of service
(OOS) for 14 days with a likelihood that the grid will be in degraded condition based on
operating experience, (2) increasing the amount of time that the grid is degraded to 30
days, and (3) an EDG taken OOS for 14 days with the grid degraded. TS approved
EDG OOS times typically range from 3 to 14 days. Operating experience shows that
the grid is degraded approximately 88 hours per year, (i.e. P[LOOP/RT]=0.01). Thirty
days was assumed to gauge the change in the risk during those times that a reactor trip
will result in a LOOP; specific analyses of the grid conditions being experienced would
provide the actual time a reactor trip may cause a LOOP.
Table 2 delta CDFs indicates that in each of these three cases, the risk is positive
indicating that the risk reduction from SBO rule implementation may be partially or fully
offset. In each of these cases, this risk increase may not be explicitly evaluated unless
the assessment considers (a) a consequential LOOP i.e. the results of electrical
analyses to determine whether a reactor trip will cause a LOOP (discussed in
Section 3.3) and other LOOPs separately (b) summer time operation and (c) actual
demand performance under LOOP conditions. Figure 1 indicates that in each of the
three cases, the risks are represented as point estimates over portions of the summer
months. The discussion follows:
(1) The first sensitivity study estimated a change in risk as a result of having one of two
EDG OOS with a 0.01 chance that the grid is degraded, i.e. P(LOOP/RT=0.01). Table 2
indicates the udelta CDF' is slightly positive indicating the risk reduction from SBO
implementation has been partially offset. Figure 1 shows this as a 14 day point estimate
in the risk as "DG/Ave" that is just above the risk "Before" deregulation. Figure 1 also
shows the corresponding CCDP of 1.1 'E-06 that was obtained by multiplying 14/365 and
the CDF/RY for this case. As stated above plant specific analyses may yield different
results.
(2) The second sensitivity study evaluated the risk from an increase in the time that a
LOOP would have resulted from a reactor trip to approximately 30 days. Table 2
indicates the delta CDP' is positive indicating the risk reduction from SBO
implementation has been partially offset thus indicating that understanding the
percentage of the time a reactor trip can potentially cause a LOOP can be important.
15
Figure 1 shows CDF/RY for this case as
deregulation.
U30
day" that is above the risk "Before"
(3) The worst case sensitivity study increases the risk above the "Before" deregulation
values by assuming one EDG is unavailable for 14 days with the reactor at power and
the grid is degraded, (i.e., P[LOOP/RT]) is 1.0. As previously discussed, TS typically
allow one EDG to be unavailable for allowed outage times (AOTs) of up to 72 hours,
and in some cases with compensatory measures, up to 14 days. Table 2 indicates the
udelta CDF' is positive and indicates the risk reduction obtained from SBO rule
implementation has been fully offset. Figure 1 shows this as a point estimate,
"EDG/WC," that is above the values before deregulation. Figure 1 also shows the
corresponding CCDP of 3.OE-05 that was obtained by multiplying the 14/365 and the
CDF/RY for this case.
(4) Appendix B evaluated changes to the risks in Figure 1 from: (a) recent
improvements in EDG unreliability from 0.0033 to 0.0027 that reduced the risk by
approximately 19 percent; (b) potentially shorter LOOP recovery times from
consideration of NRC data that assumes offsite power was available sooner than the
actual restoration time so as to reduce the risk by approximately 25 percent; (c) miltiple
reactor trips (see Section 3.3.3.) that increase the risk by approximately 200-400
percent.
The NRC does not regulate the grid; however, the performance of offsite power is a major
factor for assessment of risk. As previously discussed the licensees are expected to asse 3s
and manage the increase in the risk that may result from maintenance and outage activities;
NPPs should understand the condition of the grid before scheduling EDG, maintenance or
AOTs.
Assessment
The assessment found that major changes related to LOOPs after deregulation compared to
before include the following: (1) the frequency of LOOP events at NPPs has decreased, (2) the
average duration of LOOP events has increased, (3) where before LOOPs occurred more or
less randomly throughout the year, for 1997-2001, most LOOP events occurred during tho
summer, and (4) the probability of a LOOP as a consequence of a reactor trip has increas d.
Simplified event trees were developed to assess the impact of grid changes on overall NP?
risk, and to include the impact of the LOOP as a consequence of reactor trip. The findings
indicate: (1) the average yearly risk from LOOPs and reactor trips decreased, and (2) a small
number of events over the first 5 years of deregulated operation indicates that most of the risk
from LOOPs occurs during the summer months. Sensitivity studies indicate that the risk
reduction goals from SBO rule implementation has been maintained, except during summer
time operations with the EDG OOS or with the grid degraded.
With respect to maintaining the current levels of safety, offsite power is especially important
with regard to the risk associated with emergency diesel generator (EDG) maintenance ard
outage activities. Consequently, assessments of risk that support EDG maintenance and
outage activities should include: (a) assessment of offsite power system reliability, (b) the
potential for a consequential LOOP given a reactor trip, and (c) the potential increase in the
16
LOOP frequency in the summer (May to September). Regarding (a) above, the assessment of
the power system reliability and risks from plant activities can be better managed though
coordination of EDG tests with transmission system operating conditions.
3.2.2 General Observations
1.
The Table 1 R, S, and T events show approximately 50 grid-initiated or grid-related
reactor trips starting in 1994. Actions to prevent recurrence appear to be justified as
there are risk benefits from a reduction in the number of trips.
Table 1 shows that grid problems that effect the NPP can occur. Table 1 shows that
grid equipment failures and malfunctions were the dominant causal factor for every
event group except the R event group, which was dominated by grid and plant electrical
equipment weaknesses (see Section 3.3.1). Appendix A indicates that most of the grid
equipment failures and malfunctions were in high-voltage circuit breakers and protective
relays of the switchyard and transmission system.
2.
Some NPPs and transmission companies used experience (events 1, 2, 37 in
Appendix A) to establish or strengthen interface agreements to better control operating,
maintenance, and design activities that potentially affect the NPP. Similar agreements
could be used to enhance the maintenance of high-voltage circuit breaker and protective
relays which were previously noted to be a dominant causal factor.
In event 2, the SBO alternate ac power supply failed to start during an NPP test and the
NPP discovered that the transmission company, who owned the SBO alternate ac
power supply, installed a modification 4 months earlier that defeated its safety function.
This is an example where a contractual agreement requiring NPP review and approval
of transmission company SBO alternate ac power supply modifications may have
ensured their operability.
3.
While the data set is small, the nature of the numbers, duration, and types of the
LOOPs have changed since 1997. Table 2 above shows the number of LOOPs has
decreased from .05/RY in 1985-1996 to 0.014/RY after 1997. Based on historical data,
power restoration times following a LOOP were generally less than 4 hours. Table 2
shows the percent of LOOPs lasting more than 4 hours has increased from 17 percent
(six weather related and one plant centered) in 1985-1996 to 67 percent after 1997.
The 1985-1996 data is dominated by short plant centered LOOPs (median
approximately 20 minutes). The general absence of the short duration plant centered
LOOPs and longer duration LOOPs involving the grid now dominate the frequency.
Appendix C, Table C-1, indicates that nine of the ten LOOPs since 1997 involved the
grid or severe weather that affected the grid and included: two severe weather events
affecting the NPP switchyard, three events involving lightning strikes to the transmission
lines, one wildfire involving scheduled burning of brush under transmission lines, one
event due to a 230 kV switchyard circuit breaker failure, one event involving heavy
power system demand and transmission company equipment OOS, and one involving
the lack of communication between the NPP and the grid operator.
Further analyses of the data in Appendix C found the median LOOP recovery time
increased from approximately 60 minutes before 1997 to approximately 688 minutes
17
after 1997. As another perspective, Appendix C, Table C-1 shows NRC data that
assumed offsite power was available before it was actually connected to one safety bus;
this data shows 50 percent of the eight LOOPs involving a reactor trip lasted more Ihan
4 hours and the median LOOP recovery time was estimated to be 326 minutes.
4.
Three of the events summarized in Appendix A reached thresholds of interest (1x1(6)
from a risk perspective under the NRC accident sequence precursor (ASP) Program.
The ASP Program found the CCDPs of events 16, 33, and 58 to be 2.8E-06, 9.6E-06,
and 9.1 E-05, respectively. The CCDPs reached a threshold interest because of NF2P
conditions, not because of grid anomalies.
5.
Events indicated the sensitivity of NPP equipment to low voltage and changes in gr'd
voltages.
In event 20, the main generator voltage regulator did not respond to a system grid
disturbance created by the loss of two hydro units 15 miles from the NPP. The NPI'
voltage could not be maintained within acceptable ranges as the main generator vcItage
regulator had been miscalibrated in 1994. The voltage dropped to 80 percent of
nominal, tripping the reactor coolant pumps (RCPs) and the reactor.
Three events in Appendix A (8, 20, 34) identified microprocessor-controlled equiprrent
that was sensitive to low voltage as follows: a radiation monitor lost program memory
(event 8); several programmable controllers swapped from auto to manual following a
voltage transient (event 20); and voltage-regulating transformers shut down following a
voltage transient, and the licensee found they automatically shut down when voltage
drops to 20 percent of nominal for 6 to 8 cycles (event 34). Microprocessor-controlled
equipment has been used to replace analog equipment, and the voltage characteristics
of the replacement equipment appear to warrant attention.
Two events in Appendix A (17 and 45) show that circulating water pump synchronous
motor trips are sensitive to momentary low voltages due to switchyard and transmission
line faults. Optimizing synchronous motor protective trips may avoid some reactor trips.
In event 54, modification work at a substation in an adjacent state tripped 15 high
voltage circuit breakers and 290,000 customers lost electric service. The load
dispatcher requested the NPP to raise the generator voltage to help stabilize the glid;
however, the reactor tripped due to actuation of a non-safety related volts/hertz relay
that was set low approximately 8 years before the event.
Assessment
It is important to have formal agreements in place to ensure that grid operators will provide
reliable electrical power. Because external factors impact the ability of licensees to fully
manage risks and understand the condition of the grid, some NPP licensees have implemented
contractual agreements with grid operators to provide a mechanism for maintaining secure
electrical power in the deregulated environment. Contractual arrangements should include
specific communication protocols, operating procedures and action limits, maintenance
18
. .
1 "
responsibilities, responsibility for an SBO (alternate ac) power supply not owned by the
licensee, and NPP and grid technical parameters.
While the data set is small, the number, types, and duration of LOOPs have changed since
1997. Recent experience indicates that there are fewer LOOPs. Whereas most of the
1985-1996 LOOPs were plant-centered, most of the recent LOOPs also had major grid
involvement from the reactor trip, severe weather or lightning that affected the NPP switchyard
and transmission lines, or NPP switchyard equipment failures. Further, based on historical
data, power restoration times following a LOOP generally occur in less than 4 hours; more
recent LOOPs however have lasted significantly longer. Longer restoration for most of the
events challenge whether either the NPP or the grid operator could actually restore power to an
NPP in time under accident conditions such as an SBO and challenge the assumptions and
capabilities used in assessing plant risk from LOOPs.
Inappropriate NPP main generator voltage regulator and volts per hertz protective relay
setpoints caused a spurious reactor trip during a grid disturbance.
3.3
Nuclear Plant Voltages Not Always Analyzed for Grid Conditions Experienced
The review of the R events in Appendix A found three LOOPs (events 3, 16, and 33), five partial
LOOPs (events 15, 22, 38, 60, 62, and 64) and a voltage degradation below the minimum
voltage required by the TS for 12 hours (event 74 ) occurred coincident with, or as a result of, a
reactor trip. These events were similar as follows:
(1) Up to the time of the reactor trip, the offsite power supplies were operable per NPP control
room voltage readings that verified the TS minimum voltage requirements. In addition,
analyses of the offsite power system following a unit trip did not predict these events.
(2) A review of the previous and subsequent reactor trips at the NPPs with R events in
Appendix A found that LOOPs, partial LOOPs, and voltage degradations were not coincident
with these reactor trips. The initial grid and plant electrical conditions at the time of the R
events were different from previous and subsequent reactor trips and did not include heavy
transmission line loading, switchyard and transmission OOS, and degraded plant voltagecontrolling equipment. This is discussed further in Section 3.3.1.
(3) Eight of the 10 R events took place in June, July, and August. Seven of the 10 events were
in the Northeast (Maryland, New York, New Jersey, Pennsylvania, and Vermont where there is
a total of 20 NPPs). In the summer, the increased system loading associated with the
temperature lowers the voltage at the ends of transmission lines. This is discussed further in
Section 3.3.2.
(4) The partial LOOPs (events 15, 22, 38, 60, 62, and 64) and a voltage degradation below the
minimum voltage required by the TS for 12 hours (event 74) are not risk significant but provide
early indication that NPPs may not have fully analyzed the grid for the conditions experienced.
3.3.1
Grid Loading and Equipment Out of Service
Ideally, NPPs determine NPP voltage limits that are based on electrical system analyses that
account for the most limiting transmission system loading conditions and equipment OOS.
19
In event 74 in Appendix A, the licensee found that their failure to properly consider the impacts
of deregulation (i.e., heavy grid loading coupled with the loss of voltage support from the NPP
generator) resulted in lower than expected NPP safety bus voltage. In addition, it took 12 hours
to change power flows between Canada and Texas and get the required voltages to the NPP.
This helps to confirm the SECY-99-129 hypothesis that changes in ownership and control Df
generation and transmission facilities add to the number of entities that must be coordinated
and is likely to increase recovery times following a grid disturbance. In event 3, the licensoe
attributed the LOOP to the combined effects of heavy grid loading, a 500 kV substation OOS,
loss of voltage support from the NPP generator (resulting in a 4.5 percent voltage drop) ar d the
transfer of the NPP load (which resulted in an additional 3 to 6 percent voltage drop). The
severity of the grid condition revealed that the NPP station power transformer automatic tap
changer had not been set consistent with the design analyses so it could not compensate for
the degraded grid.
Transmission analyses typically assume at least one major pre-event equipment OOS or
contingency. Events 15, 33, 38, and 60 in Appendix A involved multiple contingencies or very
abnormal operating conditions. Event 15 involved a transmission line outage and a substation
outage that left one of two available power generation paths, and a transmission line OOS that
disabled an NPP protective trip. In event 33, the licensee attempted sustaining NPP operation
with major current unbalances in both high-voltage generator output circuit breakers. In event
38, a switchyard high-voltage circuit breaker was inadvertently closed during troubleshooting
with one of three offsite transmission lines OOS and a latent failure in a high-voltage circuit
breaker control system. In event 60, one of two high-voltage generator circuit breakers was
OOS, a latent failure existed on a switchyard disconnect switch, and NPP electrical equipment
malfunctioned.
In some events, plant equipment (such as station power transformer automatic LTC, which
control safety bus voltage levels) is assumed to be functional in the analyses of internal
voltages and by the grid controlling entity for the range of external voltages maintained at :he
NPP. Thus, an inoperable NPP transformer automatic LTC is a problem for both the NPP plant
and the grid operators. As mentioned earlier in event 15 in Appendix A, an NPP transformer
automatic LTC had not been set consistent with the design analyses. In event 16 in
Appendix A, an NPP transformer automatic LTC had been in manual for approximately
11 months due to a degraded relay and procedures that allowed its manual operation without
compensatory measures. Normal practice in these cases would be that the grid operator Would
be notified and maintain the NPP voltage so as to compensate for the inoperable startup
auxiliary transformer LTC. In addition, the licensee analyses credit the startup auxiliary
transformer automatic LTC and grid operator action to raise the NPP safety bus voltage u 3ing
an upstream transformer LTC following a unit trip. Alarms that would draw operator's attention
to inoperable safety bus voltage controlling equipment can help NPP operators identify thi
need to request additional voltage support from the grid operators. Periodic verification of NPP
transformer automatic LTC or other voltage controlling equipment operability could also help
reduce the likelihood and impact of low voltage damage to plant equipment. In addition, NPP
procedures that allow manual operation of this equipment should require compensatory
measures such as a request for voltage adjustment from the grid control entity prior to
operation.
Four events in Appendix A were also random tests of the grid that resulted in unexpected
voltage drops; these types of events may provide early signs of weaknesses in offsite power
20
system capacity and capability. In event 22, the offsite power system could not support the
simultaneous restart of two 5500 HP feedwater pump motors with a partial LOOP. In event 59
the restart of a reactor recirculation pump motor caused an unexpected voltage transient. In
event 57 the electrical perturbation from Unit 1 reactor trip, tripped a Unit 2 heater drain pump
motor and caused a Unit 2 load reduction. In event 67 seven safety and some non-safety
motors tripped, and did not restart following the voltage drop from the bus transfer and start of
two auxiliary feedwater pump motors. In events 22 and 67 if the grid does not have the
capability, automatic control circuitry could be used to minimize the probability of a LOOP.
3.3.2 Grid Reactive Capability Weakened
Several of the R events occurred in the summer in the Northeast. The PJM Interconnection
issued a publicly available study, "Results of Heat Wave 1999: July 1999 Low Voltage
Condition Root Cause Analysis," March 21, 2000 (Ref. 22), for the purposes of identifying and
correcting the root causes of low-voltage conditions on two exceptionally hot days on July 6
and 19,1999. On both occasions the 500 kV system voltage at multiple sites dropped
approximately 5 percent from highs ranging from 545 kV to 525 kV, to lows ranging from 515
kV to 495 kV. Short-term (30 minutes) grid anomalies during periods of high load are not
uncommon while the grid operating entity determines and completes response actions. PJM
was concerned that the peak load was not predicted and noted that it took several hours to
restore voltage after implementing all load management programs and 5 percent voltage
reductions. The PJM concerns are consistent with those in SECY-99-129, IN-98-07, and
IN-00-06.
The PJM data show that, in both cases, widespread system voltage degradations began near
1Oam and voltages dropped sharply at noon. The voltages were restored to the 1Oam and
noon levels in approximately 10 and 6 hours, respectively, on July 6 and in 7 and 2 hours on
July 19.
PJM found that the low-voltage conditions occurred because reactive demand exceeded
reactive supply due to record usage of electricity from high temperatures in much of the eastern
half of the U.S. Reactive supply was insufficient because some generators were unavailable or
unable to meet their rated reactive capability due to ambient conditions. Specifically, 54 PJM
generators reached a limit that restricted MVAR output to 72 percent of the reported capability
and weakened the grids capability to maintain adequate levels of voltage.
The PJM system did not have sufficient reactive capacity as required by GDC 17 and
consequently was unable to restore voltages as quickly as expected. The analyses of grid
voltage levels were incorrect because generator reactive capability design limits were used
instead of the actual capabilities. Consequently, NPP voltages used to determine operability
and analyses of offsite voltage performance after a reactor trip are likely to be optimistic unless
they consider realistic capabilities. Alternatively compensating reactive capability can be
purchased, obtained from new reactive power sources such as new generation or capacitor
banks or other reactive supply.
As another consideration, reactor power uprates also reduce generator reactive capability and
collectively weaken the grid's capacity to maintain or restore voltages as it did on the PJM
system. Licensees have been using power uprates to increase the output of their NPPs. As of
May 1, 2002, the NRC has completed 62 reviews, and the industry has collectively gained
21
approximately 3760 megawatt thermal (MWt) or 1200 megawatts electrical (MWe), an average
of approximately 20 MWe increase per NPP. However, the main generator reactive capability
decreases as the power (MW) output increases. For example, if a generator had a nameplate
rating of 1000 MVA, 95 percent power factor at rated voltage, it would correspond to an
operating point of 950 MW and 312 MVAR. If the power output increased approximately
20 MW to 970 MW, the reactive capability would decrease to 243 MVAR, a difference of
approximately 70 MVAR. Collectively, the 1200 MW increase on 62 reactors has been
accompanied by a 4340 MVAR decrease.
Assessment
An important aspect of the changes to the electrical grid is the impact on the electrical analyses
of NPP voltage limits and predictions of voltages following a reactor trip and whether a reactor
trip will result in a LOOP. Recent experience shows that actual grid parameters may be worse
than those assumed in previous electrical analyses due to transmission system loading,
equipment out-of-service, lower than expected grid reactive capabilities, and lower grid
operating voltage limits and action levels. NPP design basis electrical analyses used to
determine plant voltages should use electrical parameters based on realistic estimates of tne
impact of those conditions.
Lessons learned include:
*
LOOPs, partial LOOPs, and voltage degradations below the TS low limit following or
coincident with a reactor trip are evidence of a potential electrical weakness in the grid.
*
The synergistic effects of reduced reactive grid capability on NPPs from hot weather and
multiple reactor power uprates should be evaluated to determine the impact on the
capacity and capability of the grid to maintain adequate NPP voltages. In addition, PJM
identified numerous corrective actions for the root causes of low voltage conditions
following a heat wave.
*
In some events, non-safety related plant equipment (such as station power transformer
automatic LTCs, which control safety bus voltage levels) is assumed to be functional in
the analyses of internal voltages and by the grid controlling entity for the range of
external voltages maintained at the NPP. Periodic verification of NPP or other voltage
controlling equipment operability may be necessary to ensure their availability and
require compensatory measures such as a request for voltage adjustment from the grid
control entity should availability be compromised.
*
Under some circumstance degraded grid recovery times may take several hours. In the
Northeast, it took the grid operator for 12 NPPs 10 hours to resolve grid problems I rom
the unexpected behavior of the grid after planned voltage and load management
programs had been implemented and investigation found the grid power restoration
procedures did not work because the grid did not have the reactive capacity to quickly
restore voltages. In the Mid-West it took grid operations 12 hours to change regional
power flows and restore voltage to an NPP after the grid was stressed. These events
support the concern identified in SECY-99-129 (as discussed in the background section)
that the time needed to coordinate grid operations may increase in a deregulated
environment.
22
3.3.3 Transmission System Faults May Involve Multiple Reactor Trips
The review of the T events found that transmission system faults may involve multiple reactor
trips (events 24, 25, 48, and 53 in Appendix A). None of the events caused a LOOP. Events
48 and 53 were similar: two reactors at a dual-unit site tripped after a remote transmission line
fault opened multiple high-voltage circuit breakers, including the generator output breakers in
the switchyard.
In events 24 and 25, multiple reactors tripped, and other NPP operations were affected in a
minor way, during a grid disturbance due to the operation of common protective and/or designfeatures. The licensee final safety analysis reports (FSARs) demonstrated the adequacy of the
offsite power system by summarizing the results from power system analyses without
discussing operation of these features. In event 24, two pressurized-water reactors tripped
simultaneously due to RCP bus undervoltage during a transmission system disturbance. As a
corrective action, one of the NPPs lowered the RCP bus undervoltage and underfrequency
setpoints to the minimum allowed by the TSs. In event 25, four pressurized-water reactors
tripped simultaneously: at one site, two reactors tripped due to RCP bus undervoltage; and at
another site, two of three reactors exceeded the variable overpower trip (VOPT) setpoint during
the load swing at the NPP from the transmission system fault.
Differences in the moderator temperature coefficient (MTC) levels explain why two of three
reactors tripped at one site. The MTC is a measure of the reduction in the core reactivity as the
primary system water temperature increases. Two of the three reactors tripped when load
fluctuations (a 700 MW decrease and significant load increase due to the grid instability)
caused the steam bypass control system valves to open and exceed the VOPT setpoint within
the core protection calculators. The third reactor spiked to 102 percent power without reaching
the VOPT setpoint. The MTCs for the two reactors that tripped were -34 and -23.5 pcm per
degree Fahrenheit and near the end of core condition. The MTC for the reactor that did not trip
was more positive (-9 pcm per degree Fahrenheit) and near the beginning of core conditions.
The core protection calculator VOPT is an expected response to the load change, as are the
opening of the steam bypass control system valves, the increased steam demand, and the
resulting power increase due to decreasing temperature with a negative MTC. However, the
closer the unit is to the end of cycle (EOC), the more rapid the power increase and more likely
that VOPT will trip the reactor.
The significance of multiple unit events is that (in the cases above) the total risk from an event
would be approximately equal to the sum of the risks from the individual plants affected. Thus,
the risk in the cases above is the sum of the risks from the NPPs involved (i.e., which may be
2-4 times the individual plant risks).
As summarized in Appendix A, industry analyses of events 24 and 25 resulted in a total of 65
recommendations to address improved regional operational and engineering activities to
maintain grid reliability. The events resulted in recommendations that helped CAISO, which
was under development at the time of these events, to develop and implement a very broad
and comprehensive grid reliability program to manage and control regional operational and
engineering activities in real time. The program includes a continuous update of analyses to
reflect operating conditions and changes in operating configurations.
23
Assessment
The significance of a grid event will need to take into consideration the impact of multiple
reactor units. In addition, NPP licensee analysis of the effects of transmission system
disturbances had not been updated to account for current grid conditions. Also, one licensee
lowered RCP electrical setpoints to the minimum allowable to minimize the chance of a
premature NPP trip during a grid disturbance. Further, operation in a deregulated environnent
may be better served by a comprehensive grid reliability program to manage and control
regional operational and engineering activities in real time, as is the case with the California
ISO to maintain adequate reactive and voltage support to NPPs.
3.4
Licensees Should Contract for Adequate Voltage Support
As a result of the July 1999 events, PJM identified 20 corrective actions including one in th3
area of voltage operating criteria. The PJM Web site provides the "Voltage Criteria and Vc Itage
Limits Working Group Report," September 11, 2000 (Ref. 23), that contains the "PJM-BaseLine Voltage Limits," which are duplicated below in Table 3. Table 3 shows the PJM
transmission system voltage levels and the voltage limits for various conditions on that system.
The voltage limits are shown as a magnitude, and a decimal that is the voltage limit divided by
the system voltage. These voltage limits were part of FERC Docket No. EROO-2993-000,
"Order Accepting Tariff Filing," August 31, 2000, which
amends the PJM Operating Agreement to permit and accommodate requests that PJM
schedule and dispatch generation to meet voltage limits (in Table 4). These voltage limits are
more restrictive than those PJM otherwise determines are required for the reliable operation of
the transmission system in the PJM control area, but less than required for NPP voltage
support.
Table 3 Pennsylvania, New Jersey, Maryland Interconnection
Base-Line Voltage Limits
Voltage level
(kV)
Load Dump*
(kV)
Emergency Low*
(kV)
Normal Low
(kV)
Normal High
(kV)
Voltage
Drop**
500
475
0.95
485
0.97
500
1.00
550
1.10
5%
345
310
0.90
317
0.92
328
0.95
362
1.05
5-8%
230
207
0.90
212
0.92
219
0.95
242
1.05
5-8%
138
124
0.90
212
0.92
131
0.95
145
1.05
5-10%
115
103
0.90
106
0.92
109
0.95
121
1.05
5-10%
69
62
0.90
63.5
0.92
65.5
0.95
72.5
1.05
5-10%
* = post-contingency 5 minute Emergency Limit
post-contingency 15 minute Emergency Limit
** =
24
Table 3 uNormal" voltages of 0.95 nominal are likely to be below plaht specified limits.
Consequently, NPPs will have to request more restrictive'voltage limits per the tariff.' The entity
making the request will be responsible for all icremental generation and other costs, and PJM
will post on its Internet site its current determination of the voltage criteria that it will employ for
transmission grid reliability. In its filing, PJM used NPP voltage requirements to demonstrate
the need for the amendment to the operating agreement, stating that NPPs may have internal
plant requirements that require voltage limits different from the generic voltage limits necessary
for the transmission system.
RES previously found (Ref. 10) that CAISO and its NPP generators have implemented binding
"transmission control agreements" to ensure, in part, that the appropriate technical parameters
in the NPP analyses are explicitly stated. In a meeting between the NRC and the industry on
May 18, 2000 (Ref. 13) one of the west coast NPPs discussed the status of an NPP "grid
specification" for the grid operator. The specification gives technical details that the grid
operators need, such as NPP transient and steady state loads, as a function of time, to ensure
the 230 kV offsite power system voltage Would not go below 218 kV. The grid specification
requires inspection and preventive maintenance of 230 kV switchyard equipment under the
control of the transmission entity and important to the adequacy of the NPP off site power
system.
Assessment
Some grid operating entities that supply offsite power to NPPs, such as PJM and the CAISO,
maintain comprehensivegrid reliability programs. 'They manage and control regional
operational and engineering activities through activities such as: electrical analysis of the grid
in real time, development of time-based voltage criteria, and implementation of binding
contracts to supply electrical power to meet NPP specifications. These programs help NPPs
maintain the validity of TSs, recovery times consistent with the SBO rule, and their obligations
under GDC 17. These programs have been, in part, implemented through contractual
agreements between NPPs and grid operators so as to provide a mechanism for maintaining
some assurance of adequate reactive and voltage support for NPPs in a deregulated system to
include specific grid and NPP electrical requirements necessary to analyze and monitor the grid
for the NPP.
3.5
Emergency Diesel Generator Test With Grid Degraded May Compromise Independence
Operating experience (events 7, 24, and 56) shows that an EDG failed one of three times while
running to the grid for test given a grid transient such as one i the transmission system or from
reactor trip. In event 7, the EDG tripped as transmission system switching operations were
being performed. In event 24, the EDG was exposed to a transmission system fault while
protective relaying was ObS to allow transmission test activities. In events 7 and 24, the' EDG
tripped and realigned to the safety buses as designed. 'However, in event 24 the' EDG tripped
later in the event when attempting to restore offsite power. Better coordination of EDG test and
transmission test and operating activities might have minimized the potential for tripping'the
EDG.
In event 56, the EDG overloaded after attempting to assume a greater share of the load on the
grid when the reactor tripped. The licensee estimated that the EDG current exceeded 600
amps for 5 minutes (at least 133 percent above its continuous rating and 113 percent above its
25
short-time rating) which was just below its overcurrent trip. No EDG damage was found during
follow-up inspection and tests. It could be argued that the EDG could have been restarted
immediately, if required. Better protective relaying would trip the EDG from an overcurrert
within a few seconds of the reactor trip.
Assessment
Experience shows that running an onsite EDG connected to the grid for testing with the reactor
at power can potentially result in (a) the loss of an offsite and onsite emergency power supply,
or (b) damage to the EDG. The potential for these incidents could be reduced if the NPP and
the transmission company would better coordinate activities so that the EDG is not tested to the
grid when the grid is in a degraded condition.
3.6
Potential Damaging Effects of Current Unbalances From Grid Disturbances
A RES report "Operating Experience Assessment-Energetic Faults in 4.16 kV To 13.8 kV
Switchgear and Bus Ducts That Caused Fires In Nuclear Power Plants 1986-2001,"
February 22, 2002 (Ref. 24), discussed an event that occurred on March 18, 2001, at a nuclear
plant in Taiwan, involving a fire and SBO due to an energetic electrical fault in 4.16 kV
switchgear with an insulation failure. The CCDP for the event was 2.2E-03. The damage was
so extensive that the exact cause could not be determined. A University of Texas consultant
reviewed the NPP station logs and found that frequent unbalanced transmission line voltages
since 1985 may have resulted in current unbalances (also termed negative phase sequence
current) that prematurely aged the switchgear insulation. The utility suspected that
ferromagnetic resonance - NPP plant and transmission system equipment electrical
interactions - may have resulted in damaging levels of voltage. The available informatio,
indicated there was no safety bus protective relaying to quickly detect the conditions.
In events 33, 50, 75, and 78 in Appendix A, phase current unbalances from grid-initiated events
tripped the reactor. In three of the four events (50, 75, 78), reactor trips were initiated as a
result of current unbalances from grid events that tripped non-safety-related RCP motors,
circulating water pump motors, or the main generators. In these events, alarms also alerted
operators to abnormal current unbalances.
Event 33 shows the damaging effects of phase current unbalance on NPP switchyard
equipment. In June 1997 a switchyard relay technician reported unbalanced phase current
readings on phase B of the generator 230 kV output circuit breakers GB1 -02 and GB1 -12. The
readings for GB1-02 were 1020, 420, and 1080 amps; normally these readings are within a few
percent of each other but these readings indicate a 60 percent current unbalance. The current
readings for GB1-12 were 1182, 2100, and 1140 amps and indicate an 80 percent current
unbalance. The plant operated at 100 percent power for 2 days when the GB1-02 circuit
breaker failed and the generator and reactor tripped.
Assessment
Experience indicated that transmission system operation or disturbances may cause sustained
or frequent current unbalances that result in damage to electrical equipment. It is common
practice to protect expensive or important non-safety equipment from current unbalances.
26
Safety equipment does not always have the same level of protection. RES will further analyze
this issue in the future.
3.7
Grid Transients May Degrade Scram and Anticipated Transient Without Scram
Capabilities
Grid-induced reactor transients can effect scram capability. Events 64 and 65 in Appendix A
show that the boiling-water reactor scram or the EOC reactor recirculation pump trip (RPT) may
not occur during large load swings (approximately 800 MW) from a grid disturbance. In events
64 and 65, faults and equipment problems at an offsite 500 kV switchyard that directly feeds an
NPP 500 kV switchyard resulted in generator load fluctuations, fast closure of the turbine
control valves, and a reactor trip without the EOC-RPT. The licensee's evaluation of the events
found that a partial load rejection can actuate circuitry that causes turbine control valve motion
in excess of design assumptions and may not always actuate a reactor scram or satisfy the
EOC-RPT control logic.- The licensee found the FSAR analyses enveloped these events,
although large load fluctuations produce pressure excursions that approach those analyzed for
an anticipated transient without scram.
Assessment
Operating experience identified an instance where anticipated transient without scram
mitigation based on EOC-RPT logic failed to operate correctly during a transmission system
fault that produced large electrical load fluctuations. However, the risk associated with this
failure is expected to be very low.
3.8
Effects of Overfrequency on Reactor Integrity
Grid-induced reactor transients can affect reactor vessel integrity. The Westinghouse
evaluation of event 15 in Appendix A found that ugross tilting" or rocking of the reactor internals
(i.e., uplift of the fuel rods due to excess RCP flow) is limiting with respect to allowable reactor
coolant flow. While the licensee was taking one of two available 345 kV power generation
paths for an NPP OOS, a 345 kV relay malfunctioned, tripped the remaining power path, and
tripped the reactor following a load rejection. The equipment OOS also disabled an NPP
electrical protective trip that left the RCPs electrically connected to the main generator, which
was overspeeding from the load rejection. The RCP rated flows increased from 96 percent to
111.8 percent as a result of the increased frequency from the main generator. In analyzing the
effects of the increased RCP flow, Westinghouse found a new RCP flow limit of 115.8 percent
is more limiting than the previous 125 percent limit identified in the licensee's FSAR.
Assessment
Grid conditions which result in over-frequency conditions can have unexpected consequences.
At one plant, over-frequency conditions following a load rejection caused speed-up of the RCPs
which generated forces to within a small margin of those causing uplift of the fuel rods from
excess RCP flow. The over-frequency condition was not properly accounted for by the plant
protective relay control logic.
27
4 ASSESSMENT
Deregulation of the electrical industry has resulted in major structural changes over the past
few years. Whereas before, electric utilities produced the electricity and operated the
distribution system, that is no longer the case. In many states, the electric utilities have split
into separate generating companies, and transmission and distribution companies thereby
increasing the coordination times to operate the grid from the involvement of different
companies. In addition, generating companies have daily open access to the grid and this
changes the grid power flows and voltages so as to change the grid parameters in the NPP
design and grid operating configurations that were established before deregulation. NPPs rely
on an outside entity to maintain safety bus voltage within limits for NPP operation.
The assessment found that major changes related to LOOPs after deregulation compared to
before include the following: (1) the frequency of LOOP events at NPPs has decreased, (2) the
average duration of LOOP events has increased - the percentage of LOOPs longer than
4 hours has increased substantially, (3) where before LOOPs occurred more or less randomly
throughout the year, following deregulation, most LOOP events occurred during the summer
months (May-September), and (4) the probability of a LOOP as a consequence of a reactor trip
has increased substantially during the summer months.
Simplified event trees were developed to assess the impact of grid changes on overall NPI'
risk, and to include the impact of the LOOP as a consequence of reactor trip. The findings.
indicate: (1) the average yearly risk from LOOPs and reactor trips decreased, and (2) a small
number of events over the first five years of deregulated operation indicates that most of the
risk from LOOPs occurs during the summer months. Sensitivity studies indicate that the ri3k
reduction goals from SBO rule implementation have been maintained, except during
summertime operations with the EDG out of service or with the grid degraded.
The assessment re-enforces the need for NPP licensees and NRC to understand the concition
of the grid throughout the year to assure that the risk due to potential grid conditions remains
acceptable. To elaborate:
(1)
The NRC does not regulate the grid; however, the performance of offsite power is a
major factor for assessment of plant risk. With respect to maintaining the current levels
of safety, offsite power is especially important when considering EDG maintenance and
outage activities. Consequently, NRC and licensee assessments of risk that suppcrt
EDG maintenance and outage activities should include: (a) assessment of offsite Flower
system reliability, (b) the potential for a consequential LOOP given a reactor trip, arid
(c) the potential increase in the LOOP frequency in the summer (May to September).
Regarding (a) above, the assessment of the power system reliability and risks from plant
activities can be better managed though coordination of EDG tests with transmission
system operating conditions.
(2)
Another important aspect of the changes to the electrical grid is the impact on the
electrical analyses of NPP voltage limits and predictions of voltages following a reactor
trip and whether a reactor trip will result in a LOOP. Recent experience shows that
actual grid parameters may be worse than those assumed in previous electrical
analyses due to transmission system loading, equipment out-of-service, lower than
28
expected grid reactive capabilities, and lower grid operating voltage limits and action
levels. NPP design basis electrical analyses used to determine plant voltages should
use electrical parameters based on realistic estimates of the impact of those conditions.
(3)
With the structural and operational changes that have occurred in the industry, it is
important to have formal agreements, such as contracts between the NPP and
transmission company, in place to ensure grid operators will maintain adequate reactive
and voltage support. Some regional grid operating entities manage and control
operational and engineering activities in real time to maintain grid availability and
reliability. Since external factors impact the ability of licensees to manage risks and
understand the condition of the grid, some NPP licensees have implemented contractual
agreements with grid operators to provide a mechanism for maintaining secure electrical
power in the deregulated environment. Contractual arrangements should include
specific regulatory requirements or commitments; electrical performance requirements
under normal, transient, and accident conditions; communication protocols; operating
procedures and action limits; maintenance responsibilities; responsibility for station
blackout (SBO) (alternate ac) power supplies not owned by the licensee; and NPP and
grid technical parameters necessary to maintain adequate'electrical supply to the NPP.
Within its proper roles and responsibilities, the NRC should communicate with the
industry about the possible need for formal agreements.
Additional insights from this study include the following:
(1)
The California Independent System Operator (CAISO), the Pennsylvania-New JerseyMaryland (PJM) Interconnection, and Callaway experiences provide an opportunity for
the industry and NRC to develop lessons to be learned. As examples, CAISO found it
needed to manage and control regional operational and engineering activities in real
time to maintain adequate reactive and voltage support to NPPs, PJM identified
numerous corrective actions for the root causes of low voltage conditions following a
1999 heat wave, and Callaway modified the plant and its grid operating protocols with
the transmission entity as a result of low voltage conditions from operating in a
deregulated environment.
(2)
While the data set is small, the number, types, and duration of LOOPs have changed
since 1997. Recent experience indicates that there are fewer LOOPs. Whereas most
of the 1985-1996 LOOPs were of short duration and plant-centered, most of the recent
LOOPs are longer and had major grid involvement from the reactor trip, severe weather
or lightning that affected the NPP switchyard and transmission lines, or NPP switchyard
equipment failures. Further, based on historical data, power restoration times following
a LOOP were generally less than 4 hours; more recent LOOPs have lasted significantly
longer. Also, recent grid events, although not directly associated with LOOPs, indicate
that grid recovery times are longer. For example, in the Northeast, it took the grid
operator (of 12 NPPs) 10 hours to resolve problems from unexpected behavior of the
grid, despite implementation of planned voltage and load management programs;
investigation found insufficient reactive capacity to quickly restore voltages. In the MidWest, the grid operator needed 12 hours to change regional power flows and restore
voltage to an NPP. Longer restorations for most of the events challenge the
assumptions and capabilities used in assessing plant risk from LOOPs.
29
(3)
LOOPs, partial LOOPs, and voltage degradations below the technical specification low
limit following or coincident with a reactor trip may indicate potential electrical
weaknesses in the grid and a need for followup to prevent more serious events.
(4)
Realistic assessment of the risk from grid events will need to consider the impact o a
grid event on multiple NPPs. For example, a 1996 transmission system disturbance
resulted in the simultaneous trip of four NPPs.
(5)
Experience indicated that transmission system operation or disturbances may cause
sustained or frequent current unbalances that result in damage to electrical equipment.
It is common practice to protect expensive or important non-safety equipment from
current unbalances. Safety equipment should also have the same level of protection.
(6)
Grid-induced reactor transients can effect scram capability. Operating experience
identified an instance where anticipated transient without scram mitigation based on
end-of-cycle recirculation pump trip logic failed to operate correctly during a
transmission system fault that produced large electrical load fluctuations.
(7)
Grid conditions which result in over-frequency conditions can have unexpected
consequences. At one plant, over-frequency conditions following a load rejection
caused speed-up of the reactor coolant pumps which increased flows that generated
forces to within a small margin of those causing uplift of the fuel rods. The overfrequency condition was not properly accounted for by the plant protective relay control
logic.
(8)
The synergistic effects of reduced reactive grid capability on NPPs from hot weather or
multiple reactor power uprates should be evaluated to determine the impact on the
capacity and capability of the grid to maintain adequate NPP voltages.
(9)
Attention to non-safety related equipment could improve the response of an NPP to a
grid electrical transient or LOOP. The availability of non-safety related voltage
controlling equipment, such as station power transformer automatic tap changers that
control safety bus voltage levels, is important as these are assumed to be functional in
the analyses of internal voltages and by the grid controlling entity for the range of
external voltages maintained at the NPP. In addition, attention to non-safety relatei
NPP protective setpoints may reduce the chance of a premature NPP trip during a grid
disturbance. For example, experience caused one licensee to lower RCP undervoltage
and underfrequency setpoints to better coordinate with grid relay setpoints. In other
instances, inappropriate NPP main generator voltage regulator and volts per hertz
protective relay setpoints caused unnecessary reactor trips during a grid disturbance.
5 REFERENCES
1.
U.S. Code of FederalRegulations, Part 50, uDomestic Licensing of Production and
Utilization Facilities," Appendix A, General Design Criteria for Nuclear Power Plants."
30
2.
U.S. Nuclear Regulatory Commission, NUREG-1433, Revision 2, Standard Technical
Specifications, General Electric Plants BWRI4, June 2001 and NUREG-1431,
Revision 2, Standard Technical Specifications, Westinghouse Plants, June 2001.
3.
U.S. Nuclear Regulatory Commission, NUREG-1 032, Evaluation of Station Blackout
Accidents at Nuclear Power Plants, June 1988.
4.
U.S. Nuclear Regulatory Commission, Regulatory Effectiveness of the Station Blackout
Rule, August 15,2000 (ML003471812).
5.
U.S. Nuclear Regulatory Commission, NUREG-5496, Evaluation of Loss of Offsite
Power Events at Nuclear Power Plants: 1980-1996, June 1998.
6.
U.S. Nuclear Regulatory Commission, NRC Regulatory Guide 1.182, "Assessing and
Managing Risk Before Maintenance Activities at Nuclear Power Plants, May 2000.
7.
Nuclear Energy Institute, NUMARC 93-01, "Nuclear Energy Institute Industry Guideline
For Monitoring The Effectiveness of Maintenance At Nuclear Power Plants, February 22,
2000.
8.
U.S. Nuclear Regulatory Commission, Generic Letter 79-36, Adequacy of Station
Electric Distribution System Voltages, August 8, 1979.
9.
U.S. Nuclear Regulatory Commission, Strategic Plan, Fiscal Year 2000-Fiscal Year
2005, October 4, 2000.
10.
SECY-01 -0044, "Status of Staff Efforts Regarding Possible Effects of Nuclear Industry
Consolidation on NRC Oversight," March 16, 2001.
11.
U.S. Nuclear Regulatory Commission, The Effects of Deregulation of the Electric
Power Industry on The Nuclear Plant Offsite Power System: An Evaluation," June 30,
1999 (ML003743741).
12.
SECY-99-129, "Effects of Electric Power Industry Deregulation on Electric Grid
Reliability and Reactor Safety," May 1999
13.
U.S. Nuclear Regulatory Commission, Notice 98-07, Offsite Power Reliability
Challenges From Industry Deregulation, February 27, 1998.
14.
U.S. Nuclear Regulatory Commission, NRC Information Notice 2000-06: Off site Power
Voltage Inadequacies, March 27,2000 (ML003695551).
15.
Meeting Notes, Discussion on Grid Voltage Adequacy Issues, May 18, 2000.
(ML003722320)
16.
Letter from Ralph E. Beddle, Nuclear Energy Institute, to Samuel J. Collins, Nuclear
Regulatory Commission, "Electrical Grid Voltage Adequacy," June 26, 2000.
(ML0037275470)
31
17.
Meeting Notes, Grid Reliability Issues, October 27, 2000 (ML003757737).
18.
U.S. Nuclear Regulatory Commission, Regulatory Issue Summary 2000-24, Concerns
About Offsite Power Voltage, December 21, 2000 (ML003752181).
19.
Meeting Notes, Summary of March 15, 2002 Meeting with NEI on Grid Reliability
Issues," March 15, 2002 (ML020930268).
20.
U.S. Code of Federal Regulations, Title 10, Section 205.351, Chapter II, Report of Major
Electric Utility System Emergencies," uReporting Requirements."
21.
U.S. Nuclear Regulatory Commission, Regulatory Effectiveness of the Station Blac!(out
Rule, August 15, 2000 (ML003471812).
22.
Pennsylvania, New Jersey, Maryland Interconnection, "Results of Heat Wave 1999:
July 1999 Low Voltage Condition Root Cause Analysis," March 21, 2000.
23.
Pennsylvania, New Jersey, Maryland Interconnection, " Voltage Criteria and Voltage
Limits Working Group Report," September 11, 2000.
24.
U.S. Nuclear Regulatory Commission, Operating Experience Assessment - Energetic
Faults in 4.16 kV to 13.8 kV Switchgear and Bus Ducts That Caused Fires In Nuclear
Power Plants 1986-2001," February 22, 2002 (ML021290358).
32
APPENDICES
APPENDIX A
GRID EVENTS
Appendix A
Grid Events
This section of the appendix provides summaries of grid events that affected nuclear power
plant (NPP) performance from 1994 through 2001. The events were identified and summarized
from licensee event reports (LERs) in the NRC Sequence Coding and Search System.
Appendix A summaries provide the plant name, the source of the information, the date the
event occurred, the reactor power level, and a brief discussion of the event in relation to the grid
and the NPP.
In a few cases, the summaries reference NRC inspection reports, NRC preliminary notification
of occurrence (PNO) reports, and National Electric Reliability Council (NERC) Disturbance
Analyses Working Group (DAWG) reports. The LER, PNO, and DAWG event dates were
cross-referenced to identify the events affecting multiple NPPs in Appendix A. The DAWG
reports helped identify when the event was part of a larger grid disturbance.
Grid events were defined as events initiated from the grid and causing reactor trips or various
forms of loss of offsite power (LOOP), and events initiated by a loss of electric power from any
remaining power supplies as a result of, or coincident with, a reactor trip. For the purposes of
this study, a line of demarcation was drawn between the plant and the grid at the NPP main and
station power transformer high-voltage terminals. The grid was defined to include: (a) the highvoltage switchyard or substation nearest the NPP which is typically under the control of the
transmission organization, (b) the transmission and generation system beyond the switchyard
or substation, and (c) the protective relaying and control circuits of the switchyard and
transmission system which are often located inside the NPP. The boundary between the NPP
and the grid was based on typical organizational responsibility for equipment design,
maintenance, and operational control. In a deregulated environment this boundary is typically
the boundary between the regulated transmission system company and the deregulated
nuclear generating company.
A LOOP was indicated by the start and loading of all emergency diesel generators (EDGs). A
partial LOOP was indicated by the start and loading of one or more, but not all the EDGs.
Momentary LOOPs and partial LOOPs were indicated by the start of the EDGs; however, the
voltage quickly recovered so the EDGs did not load. Partial or momentary LOOPs are
generally not risk significant, however, for the purposes of this assessment they were used to
identify potential NPP sensitivities to a grid- related event.
The grid events were grouped as follows:
*
R events are losses of electric power from any remaining power supplies as a result of,
or coincident with, a reactor trip at power. Losses of electric power include any LOOPs,
partial LOOPs, or voltage degradations below the technical specification low limit.
*
5 events are reactor trips where the first event in the sequence of events leading to the
reactor trip was in the switchyard or substation nearest the plant.
A-1
*
T events are reactor trips where the first event in the sequence of events leading to the
reactor trip was in the transmission system beyond the switchyard or substation nearest
the plant.
*
L events are LOOPs where the first event in the sequence of events leading to the
LOOP was in the switchyard or transmission network. LOOPs at zero power are
indicated by a zero suffix.
*
PL events are partial LOOPS where the first event in the sequence of events leading to
the partial LOOP was in the switchyard or transmission network.
*
I events are events of interest that provide insights into the plant response in the
switchyard or transmission network event, but did not involve a unit trip, LOOP, or partial
LOOP.
1. S
Oyster Creek, LER 219/94-007, "Reactor Scram Due To Personnel Error While
Performing Switchyard Work." On May 31, 1994, while at 100 percent power a
reactor scram occurred due to human error while transmission company personnel
were installing a modification in the switchyard. At the time of this event, Oyster
Creek (OC) was operated by General Public Utility-Nuclear (GPUN) and the
switchyard equipment was maintained by Jersey Central Power and Light (JCF&L).
After notifying the OC control room, JCP&L Relay Department technicians loosened
a wire that caused opening of the generator output circuit breakers while installing a
digital fault recorder. After the event OC planned to establish a new agreement
between GPUN and JCP&L to strengthen the control and review of switchyard
activities.
2.1
Oyster Creek Unit 1, LER 219/94-019, SBO Power Source Unavailable Due To
Inadequate Design of Modification Due To Inadequate Administrative Control." On
October 19,1994, while at 0 percent power, the SBO combustion turbine (SBC)-CT)
failed to start during functional testing. At the time of this event, Oyster Creek (OC)
was operated by General Public Utility-Nuclear (GPUN) and the SBO-CT was under
operational control of Jersey Central Power and Light (JCP&L). Of interest was that
JCP&L modified the SBO-CT in May 1994 by installing a trip for a loss of ac power
and defeated its safety function. After the event, OC planned to establish an
agreement between JCP&L and GPUN that provides for review and testing of ll
SBO-CT modifications.
3. R
Oyster Creek Unit 1, LER 219/97-010, "Manual Reactor Scram, ESF Actuation and
Design Deficiencies Noted As A Result of Generator Exciter PM." On August I,
1997, the reactor was manually tripped from 100 percent power causing a low
voltage condition that resulted in the start and loading of the EDGs. The licensee
found that the start-up transformer (SAT) voltage regulators were not set to regulate
consistent with the degraded voltage study assumptions. When the reactor tripped
the regional grid voltage dropped 4.5 percent due to heavy demand and a 500 kV
substation out-of-service. During transfer of in-house loads to the SATs, the voltage
dropped an additional 3 to 6 percent from no-load to full load. As corrective action,
A-2
the SAT voltage regulator setpoint was raised to ensure the required voltage levels
are maintained.
4. S
Nine Mile Point Unit 1, LER 220/94-002, Reactor Scram Caused By Main Generator
Trip as a Result of Failed Output Breaker Protective Relay." On April 5,1994, while
at 100 percent power, one of the two generator circuit breakers was opened to
prepare for maintenance on a 345 kV transmission line disconnect switch. At this
time, the other generator circuit breaker tripped unexpectedly due to mis-operation
of a degraded (transmission line) protective relay resulting in a generator trip and a
reactor scram.
5.1
Nine Mile Point 1, LER 220/96-004, "Reactor Scram Caused by Turbine Trip Due to
Feedwater Oscillations." At 1318 EDT on May 20,1996, while at 100 percent power,
a turbine trip and reactor scram occurred as a result of feedwater control valve
oscillations. NERC DAWG Report No. 7,1996 indicates that at 1319 on the same
day the New York Power Pool (NYPP) initiated a 5 percent voltage reduction as a
result of the loss of NMP1 and the controlled shutdown of Indian Point 3 earlier that
day. Of interest was that the NYPP adjusted the grid voltages quickly, (i.e., 1 minute
after NMP1 tripped).
6. S
Dresden Unit 2, LER 237/00-004; Reactor Scram Due To Failure To Close Current
Transformer Knife Switches Following Maintenance." On November 30, 2000, while
at 100 percent power, the reactor and several 345 kV circuit breakers tripped when
Bulk Power Operations closed a 345 kV circuit breaker in the switchyard. Prior to
the event, substation construction personnel completed maintenance and test on the
345 kV circuit breaker that was closed without verifying proper restoration of the
equipment.
7. PL
Ginna, LER 244/94-005, "Loss of 34.5 kV Offsite Power Circuit 751, Due to Loss of
Power to #2 34.5 kV Bus at Station 204, Causes Automatic Activation of RPS
System (Turbine Runback)." On February 17, 1994, while at 98 percent power,
Rochester Gas and Electric Energy Operations opened a degraded 34.5 kV circuit
breaker at remote Substation #204. A high voltage condition followed and the
Substation #204 circuit breaker that was feeding Ginna 34.5 kV offsite power
Circuit 751 tripped. At this time, EDG "A" was being tested and loaded through
Circuit 751. The circuit breakers to safety buses 14 and 18 tripped on undervoltage,
and EDG "A" isolated and successfully powered safety buses 14 and 18. Power was
restored to safety buses 14 and 18 through Circuit 751 in 23 minutes.
8. PL
Ginna, LER 244/94-012,"Loss of 34.5 kV Ofisite Power Circuit 751, Due to External
Cause, Results in Automatic Start of B Emergency Diesel Generator." On
September 29,1994, while at 98 percent power, a tree was accidently knocked into
the 34.5 kV Circuit 751 by a private citizen operating heavy machinery. The event
resulted in a partial LOOP to safety buses 16 and 17 and the start and loading of
one EDG. Power was restored to safety buses 16 and 17 through Circuit 767 in 30
minutes. The loss of power resulted in a loss of program memory to a radiation
monitor.
A-3
9. PL
Ginna, LER 244/97-002, "Loss of 34.5 kV Offsite Power Circuit 751, Due to External
Cause, Results in Automatic Start of "B" Emergency Diesel Generator." On July 20,
1997, while at 100 percent power, 34.5 kV Circuit 751 lost power for approximately
12 hours and 15 minutes after a raccoon climbed an offsite utility pole causing i
phase to phase short. B" EDG started and loaded per design.
10. PL
Ginna, LER 244/98-005, "Loss of 34.5 kV Offsite Power Circuit 751, Due to Faulted
Cable Splice, Results in Automatic Start of "B" Emergency Diesel Generator." On
November 20, 1998, while at 100 percent power, 34.5 kV Circuit 751 lost powe* after
a cable splice failed. EDG "B" started and loaded to safety buses 16 and 17. Fower
was restored to safety buses 16 and 17 through Circuit 767 in 15 minutes.
11. PL
Indian Point Unit 2, LER 247/94-001, "ESF and Emergency Diesel Generator
Actuation." On January 26, 1994, while at 100 percent power, the in-service feeder
from Buchanan 138 kV Substation to P2 faulted resulting in (1) a 60 MW load
reduction on Unit 2 due the loss of 2 circulating water pumps and (2) start and
loading of two of three EDGs. Power was restored in 61 minutes.
12. S
Indian Point Unit 2, LER 247/95-016, "Direct Generator Trip and Reactor Trip." On
June 12, 1995, while at 90 percent power, a broken wire and ground in a pilot wire
protective relay circuit in the Buchanan 345 kV substation resulted in generator,
turbine, and reactor trips.
13. T
Indian Point 2, LER 247/96-003, "Direct Generator Trip due to Pilot Wire Feeder
Protection." On March 5,1996, while at 100 percent power, generator, turbine and
reactors trips resulted from mis-operation of a pilot wire protective relay following a
fault on a 345 kV transmission line between Buchanan and Sprain Brook
Substations. The pilot wire relay that protects equipment between Indian Point 2
and Buchanan substation had not been modified as it had at other company
locations.
14.1
Indian Point Unit 2, LER 247/96-021, Containment Isolation Valve Closure Due to
Offsite Electrical Disturbance." On October 30,1996, while at 100 percent power a
significant voltage disturbance in the 345 kV transmission system tripped one of two
generator output circuit breakers. The disturbance de-energized a radiation monitor
and caused the closure of safety related steam generator blowdown containment
isolation valves. NERC DAWG Report 26,1996 indicates that the 345 kV
disturbance was due to a faulted offsite 765 kV electrical reactor and resulted in
voltage reductions of 5 to 8 percent through-out New York. Of interest was the
voltage sensitivity of a few NPP components to the grid disturbance.
15. R
Indian Point Unit 2, LER 247/97-018, Buchanan's Substation Ringbus Breaker Trip
Caused P2 Turbine Overspeed Trip and Reactor Trip." On July 26, 1997, while at
99.4 percent power, one of two available 345 kV transmission paths for Indian
Point 2 (P2) was taken out of service for repairs. At this time a degraded protective
relay circuit in the Buchanan 345 kV Substation misoperated and tripped the
remaining transmission path for 1P2. This resulted in a loss of load to P2, a turbinegenerator overspeed, a turbine trip, and reactor scram without an immediate
generator trip. When the 345 kV transmission path was taken out of service, the
A-4
Buchanan 345 kV Substation ring bus circuit breakers were placed in a configuration
that disabled a generator protective trip. The main generator remained operational
for approximately 7 seconds until it tripped from an overcurrent condition on the P2
unit auxiliary transformer (UAT).
During the 7 seconds the main generator output remained connected to the UAT,
the turbine overspeed increased the frequency to between 68 and 73 hertz. The bus
transfer from the UAT to the station auxiliary transformer (SAT) did not take place
due to the frequency mismatch between the UAT and the SAT power supplies. In
addition, the increased frequency increased rpm of all electric motors connected to
the UAT, specifically 6.9 kV buses 1 to 4 and the 480 v safety buses 2A and 3A.
The reactor coolant pump (RCP) speed overspeed increased the RCP flow from
96 percent to 111.8 percent for 10 seconds. The licensee reported that
Westinghouse evaluation found that "gross tilting" or rocking of the reactor internals
to be limiting with respect to allowable RCP flow conditions and that a new RCP flow
limit of 115.8 percent is more limiting than the previous 125 percent limit identified in
its Final Safety Analysis Report.
After the UAT tripped, safety bus 3A lost power. EDG 22 started and was available
to feed buses 2A and 3A. The 6.9 kV buses were manually transferred to the startup transformers after the generator tripped, energizing safety buses 2A and 3A.
Motor Driven Auxiliary Feedwater (AFW) Pump 21 was then used to feed Steam
Generators 21 and 22.
16. R
Indian Point 2, LER 247/99-015, "Reactor Trip, ESF Actuation, Entry into TS 3.01,
and Notification of an Unusual Event." On August 31, 1999, the turbine and reactor
tripped from 99 percent power following spurious initiation of the RPS during
calibration. About 30 seconds later the generator tripped as designed and the
6.9 kV station buses transferred 3300 amps of load from the Unit Auxiliary
Transformer to the Station Auxiliary Transformer (SAT). A sustained low voltage
condition followed and all EDGs started and loaded. Throughout the event the SAT
tap changer remained in the manual mode due to a defective voltage control relay;
an NRC inspection report found the tap changer had been inoperable for several
months and plant procedures allowed manual operation without compensatory
measures.
EDG 23 (that was feeding bus 6A) tripped on overcurrent 14 seconds after it began
loading due to a low overcurrent relay setpoint. The EDG overcurrent trip was set at
3200 amps not 6000 amps as designed. The setpoint error was not discovered as
there was no requirement for a test to measure the actual trip point. The trip
activated from the 4400 amps surge from multiple overlapping motor starts AFW
Pump 23 starts in 12 seconds and takes 5 seconds to start; the Component Cooling
Water Pump 23 and Service Water Pump 23 start in 11 and 15 seconds,
respectively) following bus transfer.
The risk from this event was due to the loss of the EDG, one motor-driven AFW
pump, one pressure-operated relief (PORV) block valve, and automatic control of
one AFW control valve. Battery Charger 24, which is powered from bus 6A lost
A-5
power and the battery supported DC loads for 7.4 hours. Instrument Bus 24 WS
lost when the voltage on DC bus 24 became too low for Inverter 24 to provide
power. Approximately 75 percent of the safety system annunciators were lost or
more than approximately 5.5 hours. Offsite power was available the entire time but
not available without resetting the generator trip and operations believed resetting
the generator trip to be inadvisable. An NRC Inspection report calculated a CC:DP of
2E-04 assuming no credit for feed and bleed (need both PORVs), loss of AFW
pump was unrecoverable, and low probability of operator success for using the
feedwater system to provide make-up to the steam generators. The NRC ASP
Program determined the conditional core damage frequency was 2.8E-06 based on
new information that showed the feedwater system was available.
Review of P2 voltage 1993 analyses found: (1) that licensee voltage analyses. of a
LOOP, as with reactor trip, credits operation of the plant transformer automatic load
tap change (LTC) and grid operator action to raise voltage at the NPP using the
upstream transformer LTC and (2) that the plant automatic LTC had been inoperable
for 11 months and normal operating practice in such cases is to notify the grid
operator so he can maintain the required voltage until the LTC is repaired. AD the
LTC was stuck on a lower tap, about 3 percent below where it is expected to be
during normal power operation.
17. T
Monticello, LER 263/94-003, "Transmission System Electrical Fault Causes Loss of
Circulating Water Pumps Resulting in a Reactor Scram." On April 15, 1994, while at
100 percent power, a 345 kV fault due to a transmission line wave trap (a device
used transmittreceive high frequency signals through the transmission line) failure at
another generating plant switchyard caused the voltage at Monticello 345 kV
substation to drop to 55 percent for 2 to 3 cycles. The momentary decrease in
voltage tripped the synchronous circulating water pump motors and resulted in low
condenser vacuum. The reactor was manually scrammed. The low voltage
condition also tripped the Recirculation Pump Motor-Generators on a low power
factor protective trip, and caused the Emergency Filtration Train system to change
modes due to de-energized 120 volt relays.
18. T
Quad Cities Unit 2, LER 265/00-008, "Reactor Trip Due to a Main Generator
Differential Relay Operation." On July 18, 2000, while at 100 percent power a
345 kV transmission line faulted due to a failed insulator about 5 miles from the
NPP. The Unit 2 generator protective relaying circuit mis-operated tripping the
generator, turbine, and reactor. About 10 seconds later, one of the 345 kV circuit
breakers that opened to isolate the fault, automatically reclosed per design causing
the Unit 2 Reserve Auxiliary Transformer (RAT) that normally feeds the safety uses
to trip and transfer its loads to the Unit 1 Auxiliary Transformer. Power was restored
to the RAT in approximately 10 hours. The licensee found the relay mis-operaped as
the expected operation of protective relays under faulted conditions changed over
the years after the plant added and replaced current transformers in the protective
relay circuits.
19. T
Oconee Unit 2, LER 270/95-002, "Incorrect Timer Setting Due to a Design
Deficiency Results in a Reactor Trip." On April 14, 1995, while at 100 percent
A-6
power, a 100 kV transmission line fault,-an offsite substation breaker failure, and an
incorrect timer setting on the Oconee main generator loss of excitation relay resulted
in generator, turbine, and reactor trips.
20. T
Oconee Unit 2, LER 270/97-002, "Grid Disturbance Results in Reactor Trip Due To
Manufacturing Deficiency." On July 6,1997, while at 100 percent, the main
generator voltage regulator on Unit 2 did not respond to a system grid disturbance
created by the loss of two hydro units 15 miles from Oconee. The Oconee voltage
could not be maintained within acceptable ranges as the main generator voltage
regulator had been mis-calibrated in 1994. The voltage dropped to 80 percent of
nominal, tripping the reactor coolant pumps. The reactor tripped on underpower.
The voltage fluctuation also resulted in the loss of several non-safety electrical loads
in the turbine building and programmable controllers on a control room vertical
board."
21. S
Vermont Yankee, LER 271/97-023, A Component Failure in the Main Generator
Protection Circuitry Results in a Reactor Scram." On November 25,1997, while at
85 percent power, a 345 kV phase to phase fault lasting 5 cycles occurred due to
errors made during 345 kV switching to support transmission system maintenance.
The reactor scrammed due the failure of turbine-generator runback controls in
response to the 345 kV fault. The licensee stated that the switchyard equipment
was owned and controlled by the transmission entity and the NPP's received
periodic updates of the status of the switchyard.
22. R
Vermont Yankee, LER 271/98-016, "Reactor Scram on High Water Level as a
Result of a Stuck Open Feedwater Level Control Valve Due To A Cap Screw Lodged
Underneath the Valve Disk." On June 9,1998, while at 65 percent power, high
reactor water level resulted in turbine and reactor trips. About 50 minutes later
non-safety related A and B feedwater pumps motors (5500HP) auto-started
simultaneously and caused an overcurrent condition on 4 kV non-safety bus 1 that
tripped the supply circuit breaker to 4 kV non-safety bus 1 and 4 kV safety bus 3.
EDG B started and loaded to safety bus 3.
23.21
Diablo Canyon Unit 1 and 2, LER 275/94-016, "Diesel Generators Started as
Designed Upon De-Energization of Startup Bus Due to Offsite Wildfire." On
August 15, 1994, with Units 1 and 2 at 100 percent power, two nearby transmission
lines tripped due to a wildfire. Morro Bay Unit 3, one of four nearby generators, also
tripped due to the system disturbance. At this time Diablo Canyon made plans for a
two unit LOOP/reactor trip. About 13 hours after the initial fault, two more nearby
230 kV lines and Morro Bay Units 1 and 4 tripped due to the wildfire and all Diablo
Canyon 1 and 2 EDGs started but did not load. Morro Bay Unit 2 was out of service
for maintenance. Of interest was the dual unit aspect of the event.
The transmission and generation losses affected the distribution system voltage. It
was subsequently determined that the early warning sirens were inoperable for
approximately 5 hours due to the power losses.
A-7
24. 2T
On December 14,1994, a transmission line fault in Idaho affected 6 nuclear units in
California and Arizona. A Western Systems Coordinating Council (WSCC) Sys.tem
Disturbance Report noted that the event resulted in the loss of 11,300 MW of
generation for various reasons (underfrequency, overfrequency, low voltage),
divided the grid into four islands, and 1.7 million customers lost power for timeE.
lasting a few minutes up to 4 hours. During the event, voltages were as low as
81 percent of rated and noted to exceed equipment maximum rated voltages of
105 percent (typically transformer maximum allowable voltages under loaded
conditions limit maximum allowable system voltages). The frequency was as low
58.5Hz in one island and as high as 61.4 Hz in another island.
The WSCC report identified 35 recommendations to address conditions that were
not fully consistent with grid reliability criteria, relay misoperations, the need for
additional system circuit breakers, improved methods to coordinate grid operat on,
and improved voice back-up communication systems.
Diablo Canyon Unit 1, LER 275/94-020, "Reactor Trip Due to Reactor Coolant Pump
Bus Undervoltage that Resulted from an Electrical System Disturbance." On
December 14, 1994, while Units 1 and 2 were at 100 percent power, a transmission
line fault in Idaho resulted in Unit 1 and 2 reactor trips due to reactor coolant pump
motor bus undervoltage. Some primary 500 kV protective relaying was out of
service for testing. EDGs 1-1 and 2-2 started but did not load as power was
available to their buses. At the time of the trip, EDG 1-3 was paralleled to the grid
for routine surveillance testing and picked up its safety bus load. EDG 1-3 tripped
on overcurrent when attempting to restore offsite power approximately 45 minLtes
into the event. One containment fan cooler unit did not start due to a low speei
timing relay failure. The instrument uninterruptible power supply (UPS)
2-2 experienced a failed ac input due to protective features that trip the UPS during
voltage transients below 30 percent and above 20 percent normal. The UPS was
reset by cycling the ac input circuit breaker. As part of corrective action, the ROP
undervoltage and underfrequency trips were increased to the maximum alloweJ by
the Technical Specifications.
PNO-IV-94062. The grid disturbance also affected WNP-2, Palo Verde 1 & 2, and
San Onfre 2. While at 100 percent power several WNP-2 UPSs tripped off line and
realigned to their alternate power source. Palo Verde Units 1 and 2 were operating
at 98 percent and 100 percent, down-powered 1 percent, and received several UPS
alarms on the Class IE electrical system. San Onfre Unit 2 was at 98 percent power
and lost 40 MWe as a result of one of four turbine governor valves closing.
25. 4T
On August 10, 1996, at 1549 a major electrical disturbance resulted from a fault on
an overloaded 500 kV transmission line that sagged into a tree in Oregon. A
Western Systems Coordinating Council (WSCC) System Preliminary Disturbarce
Report (Draft) noted that the event resulted in the loss of 25,455 MW of generation
for various reasons (underfrequency, overfrequency, low voltage), 7.5 million
customers lost power for periods ranging from a few minutes to six hours, and
separated the grid into four islands. The industry report stated the contributing
factors were high Northwest transmission loads due to hot weather throughout the
A-8
-
:i
,l
a | 7
WSCC region, large power transfers from Canada, and equipment out of service
(three 500 kV transmission lines in the Portland area were forced out of service, a
500/230kV transformer was out for a modification, 2000 MW of generation to protect
salmon migration). The report also stated the grid was operating in a condition in
which a single contingency outage would overload parallel transmission lines;
operating studies had not been conducted for this condition so the operators were
unknowingly operating the system in a condition that violated WSCC minimum
reliability criteria.
The WSCC report identified 30 recommendations to address conditions that were
not fully consistent with grid reliability criteria, relay misoperations, the need for
additional system monitoring, operating, and control facilities; improved operating
personnel performance; improved system, operating, restoration planning; and
preventive maintenance. NERC DAWG Report 18,1996, indicates that multiple
transmission line outages over a period of one hour prior to the disturbance,
primarily related to hot temperatures, weakened the system and led to growing
voltage oscillations. The NERC report also indicates that random outages over a
short time pushed the system into an abnormal condition in which it could not
withstand the next contingency.
Diablo Canyon Units 1 & 2 are in the Northern Island where the frequency initially
dipped to 58.54Hz, spiked to 60.7Hz, drooped again to 58.3Hz and returned to
normal in 2.5 hours. The Northern Island lost 11,603 MW of load from manual and
automatic underfrequency load shedding; and 6,246 MW of generation due to low
voltage, out of step protection, and turbine-generator vibration. Diablo Canyon
Unit 1, LER 275/96-012, Reactor Trip on Units 1 and 2 Due to Major Western Grid
Disturbance," states the electrical disturbance resulted a Unit 1 reactor trip due
tripping its reactor coolant pumps (RCPs) on undervoltage and a Unit 2 reactor trip
due to loss of two of four RCPs. Two Unit 2 containment fan cooler units tripped on
thermal overload when they attempted to restart in high speed (improperly aligned).
Palo Verde is in the Southern Island where the frequency initially spiked to 61.3 Hz,
dropped to 58.5 Hz and returned to normal in 70 minutes. The Southern Island lost
15,982 MW of load from manual and automatic underfrequency load shedding; and
13214 MW due to loss of excitation, overcurrent, underfrequency, overfrequency
and line trips. Palo Verde Unit 3, LER 528/96-004, no title, states that Unit 1 and
Unit 3 reactors tripped due to load fluctuations (a substantial 700MW decrease and
significant load demand increase) that caused the steam bypass control system
(SBCS) valves to open and exceed the variable over power trip (VOPT) setpoint
within the core protection calculators (CPC). Unit 2 momentarily spiked to
102 percent power without reaching the (VOPT) setpoint.
Differences in the moderator temperature coefficient (MTC) levels explain why Palo
Verde Units 1 and 3 tripped and Unit 2 did not trip. On Units 1 and 3, the MTC was
more negative and near th6 end of core condition (EOC) on Units 1 and 3 (-34 and 23.5 pcm per'degree Fahrenheit respectively). On Unit 2 the MTC was less
negative at the beginning of core conditions (-9 pcm per degree Fahrenheit). The
CPC VOPT is-an expected response to the load change as is the opening of the
A-9
SBCVs, excess steam demand, and resulting power increase due to decreasing
temperature with a negative MTC. However, the closer the unit is to the EOC, the
more rapid the power increase and the higher probability of reaching the VOPT
setpoint.
PNO-IV-96042. At 1320 on August 12, 1996, Diablo Canyon reported that 100 of
the 135 offsite early warning sirens had been without power. Power was
subsequently restored to all sirens within 10 miles, and as of the reporting, all but
4 sirens were restored outside the 10 mile area. In addition, the grid disturbance
resulted in frequency oscillations from 58.5 Hz to 61.3 Hz and slight load losses at
San Onfre 1 & 2. WNP-2 also experienced frequency oscillations and remained
operational.
26. 21
Diablo Canyon Units land 2, LER 275/98-013, "Actuations of Engineered Safety
Features, Diesel Generators Started When Startup Power Was Lost Due to an
Inappropriate Relay Setpoint (Personnel Error)." On November 20,1998, while
Units 1 an 2 were at 100 percent power, offsite power was lost while energizing
Startup Transformer (SUT) 1-1 through a new 230 kV circuit switcher 211-1. ll six
Unit 1 and 2 EDGs started but did not load as the emergency buses remained
energized through their respective Auxiliary Transformer. The circuit
switcher 211-1 tripped due to inappropriate setting of the SUT differential relays.
The settings should have been re-evaluated due to changes in the inrush currents
from the installation of the new circuit switcher, recent replacement of SUTs 1-1 and
2-1, and new switchyard capacitor banks. Of interest was the dual unit aspect of the
event.
27. 21
Diablo Canyon Unit 1, LER 275/01-001, "Automatic Emergency Diesel Generator
Start Upon Loss of Startup Power Due to 230 kV Line Arcing in Heavy Smoke From
Escaped Fire Caused By Inadequate Administrative Controls." On April 5, 20C 1,
while Units 1 an 2 were at 100 percent power, a scheduled and controlled brush
burn generated heavy smoke that caused a phase to phase fault on 230 kV
transmission lines that supply offsite power to Diablo Canyon. All Unit 1 and 2 EDGs
started and did not load as the emergency buses remained energized through their
respective Auxiliary Transformer. The 230 kV power was restored in 73 minutes.
Of interest was the dual unit aspect of the event.
28. 21
Peach Bottom Units 2 and 3, LER 277/96-007, "Actuation Due to a Loss of One
Off-Site Electrical Source as a Result of Off-Site Substation Activities." On June 4,
1996, while Unit 2 was at 80 percent power and Unit 3 was at 100 percent power,
the 220 kV 2SU (licensee nomenclature for its transmission line) off-site power
source tripped as a result of a transmission system perturbation caused by remote
switching operation. All station buses transferred to an alternate power source. Of
interest was the dual unit aspect of the event.
29.1
Peach Bottom Unit 2, LER 277/01-001, Loss of Offsite Power Source Results in
Specified System Actuation and Safety System Functional Failure." On June 18,
2001, while Unit 2 and 3 were at 100 percent power, a raccoon caused a phase to
phase short on offsite power supply 343SU-E (licensee nomenclature for its
transmission line). The emergency 4.16 kV buses on Units 2 and 3 transferred to
A-10
their respective offsite power supply. Of interest was that due to a procedure
deficiency, two of four emergency-buses per unit would not have automatically
received power from their respective EDGs in the event of a LOOP.
30.1
Fort Calhoun, LER 285/95-003, uManual Reactor Trips Due to Water Leakage Into
Reactor Coolant Pump Lube Oil." On May 11, 1995, and May 24,1995, the reactor
was manually tripped from 100 percent power and the EDGs started but did not
load. By design reactor trip logic initiates autostart of the EDGs.
31. LO
Indian Point 3, LER 286/97-008, "Automatic Actuation of Emergency Diesel
Generators Following a Loss of Offsite Power Due to a Personnel Error that
Inadvertently Grounded the Feed to the Station Auxiliary Transformer." On June 16,
1997, while at 0 percent power, a Consolidated Edison Company substation
operator mistakenly closed the wrong ground switch to support maintenance and
caused a 138 kV phase to ground fault on the Buchanan feeder that was supplying
offsite power to P3. Two out of three EDGs started and loaded. One EDG was out
of service for maintenance. The LOOP lasted 43 minutes.
32. S
Indian Point Unit 3, LER 286/00-008, "Automatic Reactor Trip As A Result of Direct
Trip From the Buchanan 345 kV Substation Upon Protective Relay Conductors Low
Insulation Resistance Fault." On June 9, 2000, while at 100 percent power, faulted
protective circuitry wiring between P3, P3 138 kV control house, and the Buchanan
345 kV Substation control house resulted in generator and reactor trips.
33. R
Three Mile Island Unit 1, LER 289/97-007, Generator Output Breaker Failure
Resulting In A Loss Of Offsite Power and Reactor Trip." On June 19, 1997, a
switchyard relay technician reported unbalanced current readings on phase B of
generator 230 kV output circuit breakers GB1 -02 (current readings on each phase
were 1020, 420,1080 amps) and GB1-12 (current readings on each phase were
1182, 2100, 1140 amps) and a thermal scan was planned for June 23,1997.
[Phase currents are usually balanced within a few percent of each other.]
On June 21, 1997, at 0956 while at 100 percent power, A and B Main Transformer
top oil high temperature alarm was received and transformer cooling spray was
initiated at 1022 and terminated 1109. At 1145 the generator reactive power was
raised to +220 VARS per load dispatcher request, and lowered to +200 VARS at
1200 per the shift supervisor direction due to main transformer temperature rise. At
1214 230 kV generator circuit breaker GB1-02 phase B faulted to ground and failed
to open. The other generator circuit breaker GB1-12 opened as designed and
resulted in generator and reactor trips. An arc re-strike on Phase B resulted in
failure of GB1-12 and a fault on another 230 kV bus. The faulted 230 kV buses
resulted in the opening of additional 230 kV circuit breakers and a LOOP. Both
EDGS started and loaded. Offsite power was restored in 90 minutes.
The data gathered from the event indicated undervoltage occurred 2 seconds after
the generator and reactor trips. The generator residual voltage continued to feed
one fault for 17.7 seconds.
A-11
Two reactor coolant system, loop A and B, wide range pressure instruments
indicated failed to zero signals to the plant process computer. Although the
instruments were not directly affected by the loss of power, the plant process
computer input from these instruments feeds through the Diverse Scram System
and this system was de-energized by the LOOP.
LER 289/97-008, "Control Rod Trip Insertion Times Exceed TS Section 4.7.1.1
Limits," dated June 21, 1997, reports that, as a result of the LOOP, power was lost
to the control rod drive mechanisms. The licensee evaluation of the scram found
that 8 of 61 control rods exhibited slower than normal scram times and (4 of 61 were
not within Technical Specification limits) due to the hydraulically induced effect from
reduced clearances in the thermal barriers because of deposits on the internal check
valves and between the thermal barrier parts. The licensee determined that th re
would be no adverse affects associated with this condition.
LER 289/97-010, Pilot Operated Relief Valve (PORV) Inoperability Due to Being
Mis-Wired and Failure To Perform Post-Maintenance Test (PMT) Following
Replacement During 11 R Refueling Outage," dated October 12, 1997, reported that
the PORV installed during 11 R refueling outage was not capable of being opened
during the operating cycle prior to refueling outage 12R. Consequently, the PC)RV
was failed during the June 21, 1997, event.
The NRC ASP Program determined the conditional core damage frequency was
9.6E-06.
34.1
Pilgrim, LER 293/97-007, "Safeguards Buses De-Energized and Losses of Offsite
Power During Severe Storm While Shut Down." On April 1,1997, while at 0 percent
power, a LOOP occurred during a severe storm. Severe undervoltage transients
occurred on the 345 kV transmission system that resulted in automatic shutdown of
safety related 480/120v voltage regulating transformers that were installed in 1992.
Of interest was that these transformers contain programmable microprocessor
control units that automatically shutdown the transformer when the voltage drops to
384v (20 percent of nominal), in this case for 6 to 8 cycles.
35. S
Salem Unit 2, LER 311/95-004, "Engineered Safety Features Actuation (Reactor
Trip) During Unit 2 Controlled Shutdown Per Technical Specification 3.0.3." On
June 7,1995, Unit 2 began a controlled shutdown from 100 percent power due to
the inoperability of both Residual Heat Removal trains. At 20 percent reactor power,
the station non-safety buses were transferred from auxiliary to start-up power (the
safety buses are always feed from "startup" power). At 14 percent reactor power the
turbine was tripped, and both 500 kV generator output circuit breakers 1-9 and
9-10 opened. However, 500 kV circuit breaker 1-9 breaker failure relay operatad
unexpectedly, and opened two more 500 kV circuit breakers and five 13 kV
breakers. An automatic reactor trip followed due to low flow conditions in two
reactor coolant pumps from the loss of power. The licensee reported that
Westinghouse previously notified users that its SBF-1 breaker failure relay was;
susceptible to premature actuation and recommended actions to prevent
malfunction.
A-12
36. S
Arkansas Nuclear One, LER 313/95-009, "Reactor Trip on High Reactor Coolant
System Pressure Which Resulted From Closure Of The Main Turbine Governor And
Intercept Valves Due To The Failure Of A Main Generator Output Circuit Breaker
Contact." On July 15, 1995, while at 100 percent power, a reactor trip occurred
when one of the two main 500 kV generator output circuit breakers was opened for
maintenance. The Electro Hydraulic Control system sensed that the both 500 kV
generator output circuit breakers were open due to a failed auxiliary contact in the
closed 500 kV generator output circuit breaker.
37. 2PLO
D.C. Cook Unit 1 & 2, LER 316/00-004,"Partial Loss of Offsite Power Results in Start
of Emergency Diesel Generators." On June 8, 2000, while Units 1 and 2 were at
0 percent power, Transmission Department personnel inadvertently opened the
wrong 34.5 kV switch resulting in a partial loss of power to Unit 1 and 2 Train A
buses. The EDGs on both units started and loaded as expected. It was planned
that the Interface Agreement between D.C. Cook and American Electric Power
(AEP) Western Transmission Region would be revised to require concurrent
verification of switching operations in the switchyard.
38. R
Calvert Cliffs Unit 2, LER 318/96-001, "Automatic Plant Trip Due To Partial Loss of
Offsite Power." On February 2,1996, while at 100 percent power, plant personnel
and System Operation and Maintenance Department (SOMD) were troubleshooting
a switchyard circuit breaker with two out of three offsite transmission lines in service.
Less than adequate work control and a relay card failure in a 500 kV circuit breaker
caused three 500 kV switchyard circuit breakers to trip resulting in the concurrent:
(1) loss of power to the Unit 2 reactor coolant pumps (RCPs) and the automatic
reactor trip of Unit 2 on low RCP flow and (2) loss power to one vital bus on Unit 1
and another on Unit 2 and the start and loading of EDGs 12 (Unit 1) and 21 (Unit 2).
During troubleshooting activities a SOMD analyst recommended closing of the
switchyard circuit breaker and no one recognized that this invalidated the original
premise of the plant circuit breaker troubleshooting plan that no breaker would be
operated.
39.1
Diablo Canyon 2, LER 323/97-002, uReactor Trip on Low-Low Steam Generator
Water Level Following the Failure of Main Feedwater Pump 2-1 Due to Mechanical
Problems." On March 29,1997, the reactor tripped from 50 percent power on steam
generator (SG) water level low-low in SG 2-2 due to loss of one main feedwater
pump. Prior to the reactor trip, operators compensated for the partial loss of
feedwater by rapidly reducing the load from 100 percent to 50 percent and starting
all (two motor driven and one steam driven) auxiliary feedwater pumps. EDGs 2-2
and 2-3 started due to the momentary voltage dip on their respective buses during
the bus transfer to start-up power. The EDGs did not load as the voltage recovered
quickly. DG 2-1 did not start due to different loading conditions on the vital bus. By
design, the EDG autostarts if the voltage has not recovered within 1 second.
40.1
Diablo Canyon 2, LER 323/97-003, Manual Reactor Trip on Loss of Normal
Feedwater Due to Unknown Condensate/Feedwater Transient." On July 27, 1997,
the reactor was manually tripped after the loss of both main feedwater pumps.
Operators initiated a load reduction and two motor driven and on a steam driven
auxiliary feedwater pumps started automatically. EDG 2-2 started due to the
A-13
momentary voltage dip. The EDG did not load as the voltage recovered quickly. By
design, the EDG autostarts if the voltage has not recovered in 1 second.
41.1
Diablo Canyon Unit 2, LER 323/98-005, "Manual Reactor Trip Due to Heavy Debris
Loading of the Circulating Water System During a Pacific Ocean Storm." On
December 1, 1998, operators initiated rapid Unit 2 generator load reduction from
100 percent to 50 percent and subsequently tripped the reactor due to heavy debris
loading of the circulating water systems during a Pacific Ocean storm. EDG 2-2
started following bus H transfer to startup power, but did not load as startup pcwer
was available to the 4 kV buses. By design, the EDG autostarts if the voltage as
not recovered in 1 second.
42. Lo, PL Brunswick Unit 2, LER 324/94-008, "Dispatcher Switching Evolution Results in Loss
of Offsite Power to Unit 2. On May 21, 1994, while Unit 2 was at zero power the
dispatcher made an error while executing six actions as part of returning a 23 kV
line to service. The actions were completed in 52 seconds and the time between
actions did not allow for self checking or feedback from the Brunswick control room.
All Unit 1 and 2 EDGs started and the Unit 2 EDGs loaded.
43.L0
Brunswick Unit 1, LER 325/00-001, "Loss of Offsite Power During a Refuel Outage."
On March 3, 2000 while Unit 1 was at zero power and Unit 2 was at 100 percent
power, utility transmission maintenance technicians mispositioned a switch in
protective relay circuitry during switchyard relay trip activities. A LOOP occurred on
Unit 1. The Unit 1 and 2 EDGs started. The Unit 1 EDGs loaded; however, one
EDG failed to.run due to failure of is excitation system transformer.
44. S
Sequoyah Unit 1, LER 327/96-006, "A Failed Coupling Capacitor Potential Device
Caused Actuation of the Generator Backup/Transformer Feeder Relay Trippirg the
Turbine and the Reactor." On June 26,1996, while at 100 percent power, a
coupling capacitor potential device in the 500 kV switchyard faulted and caugl-t fire
resulting in generator, turbine, and reactor trips.
45. S
Sequoyah Unit 2, LER 328/95-007, "Reactor Trip With Auxiliary Feedwater Start and
Feedwater Isolation as a Result of a Switchyard Power Circuit Breaker Failure." On
December 12, 1995, while at 100 percent power, a 161 kV transmission line circuit
breaker opened to clear a ground fault due to a latent defect in one of its insulators.
The perturbation was sensed by protective circuitry on 2 of 3 and all synchronous
circulating water pump motors (CCPM) on Unit 1 and Unit 2, respectively. Unit 2
reactor was manually tripped due to loss of condenser vacuum due to the losE of the
CCPMs. Security system lost power after transferring to its UPS but its batterl was
"faulty."
46. T
Beaver Valley, LER 334/94-005, "Main Transformer Bushing Failure Results in
Electric Grid Disturbance and Dual Unit Reactor Trip." On June 1,1994 while nits 1
and 2 were at 100 percent power, a bushing failure on the Unit I Main Transformer
initiated a voltage disturbance on the grid. Generator and reactor trips followed.
The transformer fault also causes a voltage perturbation on the grid that caused
inadvertent actuation of protective relaying that tripped the 138 kV transmission line
that was supplying Unit 2 System Station Service Transformer (SSST) 2A. The loss
A-14
of SSST 2A resulted in actuation of the two reactor coolant pump underfrequency
protective relays, a Unit 2 reactor trip, and the start and loading of one Unit 2 EDG.
47. I
Beaver Valley Unit 1, LER 334/96-008, "Reactor Trip During Solid State Protection
System Turbine Testing." On May 31, 1996, the reactor tripped due to an
inadvertent turbine trip signal generated during RPS Testing. All auxiliary feedwater
pumps (2 motor driven and one steam) started. The B train EDG automatically
started but did not load in response to a momentary undervoltage condition. The
licensee stated that calculations showed the EDG may start as the EDG
undervoltage diesel start trip setpoint is very close to the actual value expected
during a fast bus transfer and reactor coolant pump re-starts.
48. 2T
Beaver Valley Units 1 & 2, LER 334/97-005, "Inadvertent Operation of 345 kV
Backup Timer Relay Results in Dual Unit Reactor Trips." On March 19, 1997, while
Units 1 and 2 were at 100 percent power, both units experienced simultaneous
reactor trips following a grid disturbance. A fault on remote 345 kV transmission
line, whose primary protective relaying was out of service, resulted in shedding
various loads through opening of transmission line circuit breakers. Eight circuit
breakers opened in the Beaver Valley Switchyard. Beaver Valley Units 1 and 2
reactors tripped after Unit I and 2 generator 345 kV output breakers opened due to
inadvertent operation of a breaker failure and its backup timer relays on the
#3 345 kV bus in response to the disturbance. An events recorder indicated Unit 1
safety bus voltage dipped for 0.2 seconds and Unit 1 EDG-1 autostarted (voltage dip
duration was above setpoint of 0.198 seconds) and the other safety bus voltage
dipped for 0.166 seconds but EDG-2 did not autostart (voltage dip duration was
below setpoint of 0.194 seconds).
49. S
St. Lucie Unit 1, LER 335/94-007, "Automatic Reactor Trip on Loss of Electrical Load
Due To Flashover On 240 kV Switchyard Potential Transformer." On October 26,
1994, while at 100 percent power, a potential transformer failed and caught fire in
the 240 kV switchyard resulting in generator, turbine, and reactor trips. As a result,
Utility Power Delivery replaced its potential transformer and began replacing other
potential transformers in its switchyard maintenance coating program.
50. T
North Anna Unit 1, LER 338/96-010, "Automatic Reactor Trip Due to Failure of a
Generator Negative Phase Sequence Relay." On October 24, 1996, while at
100 percent power, a fault occurred on a 230 kV transmission line in North Carolina
and produced a negative phase sequence current of 1 percent at North Anna. The
line fault cleared; however, Unit 1 reactor tripped due to the negative phase currents
from the fault and the 4.6 percent downward calibration drift of its main generator
negative phase sequence relay that was set for approximately 6 percent.
51. S
North Anna Unit 1, LER 338/00-004, "Automatic Reactor Trip Due to Malfunction of
Generator Circuit Breaker." On May 7, 2000, while 100 percent, a suspected ground
in one of two 500 IN-generator circuit breakers resulted in generator, turbine, and
reactor trips.
52. S
Fermi 2, LER 341/98-001, "Automatic Reactor Scram Due to Main Turbine Trip." On
February 1, 1998, while at 96 percent power, a Nuclear Power Plant Operator
A-15
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
actuated a test switch in the 345 kV relay house for a 345 kV transmission line that
tripped the transmission line circuit breaker, both 345 kV generator output circLit
breakers, and the reactor. The test exposed degraded conditions that existed on
two 345 kV transmission line relays that activated the circuit breaker trips.
Maintenance of protective relaying equipment in the 345 kV switchyards is
performed by corporate Equipment Performance and Predictive Maintenance
personnel under a Fermi work request.
53. 2T
Limerick Units 1& 2, LER 352/95-002, "Dual Unit SCRAM Due to an Offsite Electrical
Transmission Disturbance." On February 21, 1995, while Units 1 & 2 were at
100 percent power, 220 kV transmission line 220-61 to Limerick tripped following a
fault. A circuit breaker at an offsite substation failed, causing a voltage spike that
faulted and failed a lightning arrester. Several other transmission lines tripped as a
result of the fault. Transmission line 220-61 automatically isolated in 2 seconds and
returned to service in 4 seconds but not before Unit 1 and 2 main transformer relays
initiated Unit 1 and 2 generator and reactor trips. The primary and secondary
ground fault detection relays failed to properly trip at the offsite substation befc re the
Limerick units tripped. About 0.5 seconds after 220-61 was restored,
220 kV transmission line 220-60 tripped due to ground fault current at another offsite
substation. The safety bus voltage dropped from 4320v to 4020 v which was riot
enough to start the EDGs. One Unit 2 non-safety 13 kV bus failed to transfer due
circuit breaker failure.
54. T
Limerick Unit 2, LER 353/96-004, uReactor SCRAM Resulting From a Main
Generator Lockout Due to the Actuation of a Volts/Hertz Relay Caused by an
Inadequate Design Change Package." At 1033 on May 5, 1996, while at
100 percent power, inappropriate actuation of a volts/hertz relay due to a low
setpoint (made in 1988) resulted in generator, turbine, and reactor trips. NERC
DAWG Report 6, 1996, indicates that at 1009, the Pennsylvania, New Jersey, and
Maryland (PJM) grid started experiencing grid instabilities due a fault in Delaware
that tripped several transmission lines and transformers. The industry report
indicates the incident occurred during modification work at a substation in Delaware
and tripped 15 high voltage circuit breakers and 290,000 customers lost electric
service. Just after 1009 and again at 1030 the load dispatcher requested Limerick
Unit 2 to pick up additional reactive load (and raise the generator voltage, and the
volts/Hertz) to help stabilize the grid.
55. S
Limerick Unit 2, LER 353/99-006-01, Generator Lockout and Scram Due To F-ailure
of B Phase Main Transformer Surge Arrestor." On December 31, 1999, while at
100 percent power load dispatchers were removing a 500 kV capacitor bank from
service when a 500 KV generator output circuit breaker phase B grading capacitor
failed. The capacitor failure resulted in a voltage transient that caused a failure of
the B-phase main transformer 500 kV lightning arrester which was sensed by ground
fault protective relaying that resulted in a generator and reactor trip. The
undervoltage from the ground fault caused the Drywell Chiller, Reactor Building
Enclosure HVAC system, and Turbine Building Enclosure HVAC system to trip.
A-16
56.1
LaSalle Unit 1, LER 373/94-011, "Unit 1 Scram Due to a Feedwater Signal Spike."
On July 8,1994, while at 58 percent power the reactor tripped due to a feedwater
transient. Of interest was the that EDG B," which was running to the grid for a
scheduled surveillance test, assumed an abnormal amount of current as a result of
the grid disturbance caused by the loss of the Unit 1 generator. The licensee
estimated that the EDG current exceeded 600 amps for 5 minutes and did not reach
its overcurrent trip; no damage was found during inspection and tests. [The EDG is
rated for approximately 450 amps so this was a 133 percent overload.]
57. S
LaSalle Unit 1, LER 373/01-001, "Reactor Scram Due To Electrical Fault on
Transformer Yard 345 kV Line C Phase." On January 31, 2001, while at
100 percent power, a dirty support insulator between the Unit 1 main power
transformer and the 345 kV switchyard flashed over causing generator and reactor
trips. The electrical perturbation caused the loss of the Unit 2 2A heater drain pump
and a unit load reduction.
58. T
Waterford Unit 3, LER 382/95-002, "Reactor Trip and Non-Safety Related
Switchgear Fire." On June 10, 1995, while at 100 percent power a failed 230 kV
lightning arrester at the Waterford Substation, (Waterford Unit #2 transformer)
caused the Waterford Unit 3 Main Transformer protective relays to operate and trip
the generator and reactor. A circuit breaker failure resulted in a non-safety related
6.9 kV switchgear fire that lasted approximately one hour. EDG "A" started and
loaded as a result of the loss of power to one safety bus. The NRC ASP Program
determined the conditional core damage frequency was 9.1 E-05.
59. S
Susquehanna Unit 2, LER 388/95-005, "Reactor Scram Following Turbine Trip on
Load Reject." On April 15, 1995, while at 100 percent power, one 500 kV motor
operated disconnect switch was opened to support switchyard bus maintenance. An
incorrectly configured cam switch in the 500 kV motor operated disconnect switch
activated a protective relay causing a generator and reactor trip. The voltage
transient from the restart of the B Reactor Recirculation Pump resulted in several
unexpected containment isolation valve isolations and de-energized two instrument
ac power panels.
60. R
Harris Unit 1, LER 400/96-008, "Reactor Trip Due to the Failure of a Switchyard
Breaker Disconnect Switch." On April 25, 1996, while at 100 percent power and one
of two generator output circuit breakers in service, a manual 230 kV disconnect
switch for the in-service generator output circuit breaker failed resulting in the
opening of the other generator circuit breaker. Generator and reactor trips followed.
Undervoltage relay contact bounced closed momentarily following the shock from
opening and closing bus circuit breakers during bus transfer. The false
undervoltage signal resulted in the loss of several non-safety motors and the B train
safety bus. The B EDG started and loaded.
61. PL
Nine Mile Point Unit 2, LER 410/98-006, "Engineered Safety Features Actuations
Due to Partial Loss of Offsite Power." On March 28, 1998, while at 92 percent
power, a partial LOOP lasting approximately 195 minutes occurred following the
failure of a Scriba 345 kV switchyard circuit breaker that de-energized the
A-17
345/115 kV transformer that supplies one of two 115kv sources of offsite power to
Unit 2. Division I and IlIl EDGs started and loaded. The transmission entity had
responded to a "345 kV Breaker Trouble" alarm received by the grid control operator
and classified the alarm as not requiring notifications to NMP2.
62. R
Nine Mile 2, LER 410/99-010, "Unit 2 Reactor Trip due to a Feedwater Master
Controller Failure." On June 24,1999, while at 100 percent power the reactor
tripped due to the failure of the feedwater master controller. The 13.8 kV buse.s fast
transferred to offsite power and a 115kV line circuit breaker tripped unexpectec y.
Division I and Ill load electrical power and their EDGs started and loaded. The
115 kV line tripped because a primary protective relay for one of the 345 kV main
generator output circuit breakers failed, initiating a backup protective scheme that
tripped the 345/115 kV feeder that was supplying offsite power to Unit 2.
63. S
Grand Gulf, LER 416/95-010, "Reactor Scram Due To Turbine/Generator Trip." On
July 30, 1995, while at 100 percent power, a current transformer in one of the
500 kV generator output circuit breakers failed causing generator, turbine, and
reactor trips.
64. R
Grand Gulf, LER 416/00-005, "Automatic Scram Due to Offsite 500 kV Circuit
Breaker Failure." On September 15, 2000, while at 100 percent power, a ground
fault and 500 kV circuit breaker failure at an offsite switchyard that directly feecs the
Grand Gulf 500 kV Switchyard resulted in generator load fluctuations, fast closure of
the turbine control valves (TCV), and a reactor trip. One EDG started and loaded
due to low grid voltage. The end of cycle reactor recirculating pump (EOC-RPT) trip
did not operate. LER 416/00-006, Unanalyzed Condition-Turbine Control Valves
May Move in Excess of Design Assumptions," found that a main generator partial
load rejection can actuate circuitry that causes TCV motion in excess of design
assumptions and may not always actuate a reactor scram/EOC-RPT downshift.
(EOC-RPT logic was not satisfied.)
65. T
Grand Gulf, LER 41 6/01-003, "Automatic Scram Due to Offsite 500 kV Switchyard
Problem and EOC-RPT Pump Failure." On August 7, 2001, while at 100 percent
power, a 500 kV disconnect switch failure at a remote switchyard that feeds the
Grand Gulf switchyard resulted in generator load transient, turbine trip, and scram.
The EOC-RPT did not occur.
66. S
Vogtle Unit 2, LER 425/94-001, uAutomatic Reactor Trip Due to Turbine Trip
Resulting From Trip Of Switchyard Breakers." On January 7, 1994, while at
100 percent power, a loose wire connection in a 500 kV switchyard protective circuit
for a 500 kV electrical reactor tripped one of two 500 kV generator output circuit
breakers. Two additional 500 kV circuit breakers tripped, including the remaining
Unit 2 500 kV generator output circuit breaker, due to low air pressure indicatic ns
that activated breaker failure protective relaying. Generator, turbine, and reactor
trips followed.
67. S
Seabrook Unit 1, LER 443/98-014, "Reactor Trip Due To Pole Disagreement oi
345 kV Breaker." On December 22, 1998, while at 100 percent power, a pole
A-18
disagreement switch (a switch that monitors whether all three poles of a circuit
breaker operate together) in one of two 345 kV generator output circuit breakers
malfunctioned when it was opened to support transmission line maintenance. The
switch malfunction activated backup protective relays that opened three more 345
kV circuit breakers, including the remaining generator output circuit breaker.
Generator, turbine, and reactor trips followed. All but one bus, non-safety 4 kV bus,
transferred to offsite power. One Startup Feedwater Pump failed to start due to the
loss of power, and the electric and steam driven Emergency Auxiliary Feedwater
Pumps automatically started. During the event the voltage transient caused some
safety loads (Control Room Makeup Fan, Spent Fuel Pool Cooling Pump, Train-A
Switchgear Area Supply and Return Fans, and three Containment particulate
Radiation Monitor isolation valves) and non-safety loads (Loose Parts Monitoring) to
trip and not restart when power was restored. The license reported that this was the
second event where this switch malfunctioned however, the first event was not
required to be reported as it did not cause a reactor trip.
68. S
Comanche Peak Unit 1, LER 445/97-009, "Slow Opening of the Unit 1 East Bus
Supply Resulted in Turbine Trip and Subsequent Reactor Trip." On October 27,
1997, while at 100 percent power one of the two 345 kV generator outputs circuit
breakers was slow to open during test, activating backup protective relaying that
resulted in generator, turbine, and reactor trips. The licensee also noted that the
work instructions were insufficient in that the backup protective relaying should have
been defeated for test.
69. L
Bryon Unit 1, LER 454/98-017, "Line 0621 Trip and Subsequently, Loss of Unit 1
SATs Causing Loss of Offsite Power. On August 4, 1998, while at 100 percent
power, a 345 kV transmission line faulted and tripped two 345 kV circuit breakers at
Bryon and two at the remote end of the transmission line. Lightning was believed to
be the most likely cause of the fault and it had no effect on the NPP. Of interest was
that during power restoration, a LOOP occurred while at 100 percent power when a
345 kV circuit breaker supplying off site power to the NPP opened upon reclosure of
one of the two Bryon 345 kV circuit breakers due to failure a 345 kV transmission
line relay failure to reset, a NPP 345 kV switchyard alarm response procedure
inadequacy, and improper 345 kV circuit breaker synchronization timing. Both
EDGs started and loaded. The load dispatcher reclosed the remote circuit breakers
shortly after the loop occurred. However, the power restoration activities took
8 hours for coordination with the Nuclear Analysis Operational Department,
walkdowns, resetting relays, and visual inspection.
70. S
Bryon Unit 2, LER 455/00-001, "Automatic Reactor Trip System Actuation Due to
Off-site Power Line Fault and Failed Air Circuit Breaker. Load Rejection Contact."
On January 13, 2000, while at 100 percent power, a fault resulted after a static line
on an offsite transmission tower associated with Unit 1 fell on one phase of a
transmission line associated with Unit 2. Protective relays isolated the fault opening
two Bryon 345 kV switchyard circuit breakers including one of the Bryon 2 345 kV
generator output circuit breakers. A failed control contact in the other Bryon 345 kV
generator output circuit breaker resulted in generator, turbine, and reactor trips.
A-19
71. S
River Bend Station, LER 458/99-014, "Automatic Reactor Scram Due to
Inappropriate Work Activities in the Plant Substation." On October 29, 1999, While
at 100 percent power, a utility technician who was authorized to install a
communications microwave panel in the 230 kV Fancy Pont Substation, mistakenly
tested and activated protective relay circuits for the main generator 230 kV outout
circuit breakers resulting in generator, turbine, and reactor trips.
72. S
Clinton, LER 461/96-004, "Inadequate Job Preparation for a Preventative
Maintenance Task on a Switchyard Breaker Causes Main Steam Isolation Valve
Closure and Reactor Scram." On April 9, 1996 while at 100 percent power,
protective relaying activated while utility personnel were maintaining one of the
345 kV circuit breakers that supplies offsite power through the reserve auxiliar'
transformer (RAT) to the safety and non-safety related buses when the unit is on
line. The safety buses transferred to an alternate supply in 2.5 seconds. The
non-safety buses lost power causing the turbine building main steam line high
temperature instruments to lose power, initiate nuclear steam protection system
logic that closed the main steam isolation values, and scram the reactor. The
severe transients on the normal power supply caused the circuit breaker for the rod
control and information system core map display to trip on an overcurrent condition
caused by the voltage decay. The reactor operator observed that some of the rods
did not indicate full insertion, initiated a manual scram, and Alternate Rod Insejtion
after some rods still indicated they had not inserted. It was determined that all rods
did scram and that the rod insert indications were anomalous due to an unknown
cause.
73. LO
Clinton Power Station, LER 461/99-002, "Offsite Fault on In-service Offsite Electrical
Supply Line Causes Loss of Offsite Power to Safety Related-Electrical Buses.' On
January 6, 1999, while at zero power and one of two transformers that provide
offsite power was out-of-service for scheduled maintenance, the 138kV offsite power
feed to the in-service transformer faulted. A guy wire for an offsite power pole pulled
out of the ground, causing the pole to lean and fault. All three EDGs started and
loaded. The EDGs ran for approximately 10 hours until the safety buses were
transferred to alternate offsite power.
74. R
Callaway, LER 483/99-003, "Manual Reactor Trip Due To Heater Drain System Pipe
Rupture Caused by Flow Accelerated Corrosion," and LER 483/99-005, "Operating
Conditions Exceeding Previously Analyzed Values Results in Inoperability of Bath
Offsite Power Sources." On August 11, 1999, at 0907 the reactor was manually
tripped from 100.78 percent power due to a feedwater drain line pipe rupture
(LER 483/99-003). On August 12, 1999, while at zero power, the switchyard voltage
supplied from the grid decreased below the minimum operability level established in
station procedures for 12 hours. The voltage drop resulted from near peak levels of
electric system loading and the transport of large amounts of power on the grid near
Callaway. The grid conditions were due to high temperatures. Licensing
correspondence (ML01 0990214) notes that the licensee stated that the deregulated
wholesale power market contributes to conditions where higher grid power flovs are
likely to occur as in this case.
A-20
The licensing correspondence also indicated that the plant was subsequently
modified to replace the existing transformers that normally supply power to the
safety buses from the 345 kV transmission network with new transformers that
include automatic tap changers. Due to changes in the nature of the transmission
system in the vicinity of Callaway, a wider range of grid voltages were expected in
the future. The new transformers combined with the previously installed 6 MVAR
capacitor banks will assure acceptable voltages are provided to the safety buses. In
addition, the licensee advised that the transmission system operator, AmerenUE
Energy Supply Operations (ESO) monitors and models the grid voltage, including
the Callaway switchyard voltage. In addition to seasonal grid load flow analysis,
ESO performs real time analysis under conditions being experienced and postulated
credible contingencies such as the loss of Callaway.
75. T
Callaway Unit 1, LER 483/00-002, "Automatic Reactor Trip Initiated By Reactor
Coolant Pump Trip Caused By Motor Current Imbalance Due To External
Transmission System Disturbance." On February 13, 2000, while at 100 percent
power, a fault occurred in a neighboring electric cooperative's transmission line. The
fault did not clear due to neighboring utility protective relay weaknesses, and for the
next eight minutes, multiple subsequent faults were introduced onto the system.
Approximately one minute into the event the B reactor coolant pump (RCP) tripped
on current imbalance causing a low flow condition that tripped the reactor.
Subsequent to the reactor trip all RCPs and main condenser circulating water pump
motors tripped on motor current imbalance. NRC Inspection Report 50-483/00-01
notes that breaker protection for a 161 kV transmission line in southeast Missouri did
not operate causing significant voltage fluctuations on the Callaway switchyard
buses.
76. T
South Texas Unit 1, LER 498/95-013, 'Turbine Trip and Reactor Trip Due to Main
Transformer Lockout." On December 18, 1995, while Unit 1 was at 100 percent
power, a transmission line fault with a grounded plant current transformer protective
circuit wiring caused backup protective relaying to incorrectly trip the main
transformers.- Generator, turbine and reactor trips followed. The train A EDG
automatically started and loaded. A pinched wire caused the grounded condition.
77. PL
South Texas Unit 2, LER 499/99-003, "Engineered Safety Feature Actuation and
Entry Into Technical Specification 3.0.3 Following a Partial Loss of Offsite Power,
-and Failure to Verify ESF Power Availability per Technical Specification
Requirements." On March 12,-1999, while at 100 percent power, a partial LOOP
occurred after a 345 kV circuit breaker faulted. EDGs "B" and "C" started. EDG C"
loaded and EDG B" did not load as its output circuit breaker did not close due to a
failed to cell switch.
78. S
South Texas Unit 2, LER 499/01-002; "Manual ReactorTrip as a Result of
Switchyard Breaker Failure." On March 1, 2001, while at 95 percent power, the plant
was realigning the 345 kV switchyard circuit breakers to support maintenance.
Unknown to the switchyard and operating crews, one pole of a 345 kV circuit
breaker stuck open after it was closed creating a phase imbalance that tripped
Circulating Water Pump 21 on phase balance overcurrent. The imbalance also
caused a main generator negative phase sequence alarm, high voltage alarms on
A-21
Standby Bus 2F and Auxiliary Bus 2H, and the trip of Circulating Water Pumps 22
and 24. A manual reactor trip was initiated.
79.1
Palo Verde Unit 1, LER 528/95-001, "Entry Into Technical Specification 3.0.3 Due To
Transient Grid Voltage." On February 15, 1995, while at 100 percent power Control
Room personnel were notified by the Emergency Control Center (ECC) that the Palo
Verde switchyard voltage had dropped below the administratively imposed limit of
525 kV for a short time (lowest reading 518 kV). The voltage was restored to ormal
level of 528 kV by a 100 MVAR increase on Unit 1. Of interest was that (1) ECC
personnel had not anticipated the severity of Palo Verde switchyard voltage drop to
518 kV during performance of switching activities: lowering VARS and removing a
transmission line from service, and the (2) the influence of the Palo 1 on the
switchyard voltage.
80.1
Palo Verde Unit 1, LER 528/95-003, "Entry Into Technical Specification 3.0.3 Due To
Transient Grid Voltage," and NERC disturbance report. On July 29, 1995, while at
100 percent power Control Room personnel were notified by the Energy Control
Center (ECC) that the Palo Verde switchyard voltage had dropped below the
administratively imposed limit of 524 kV for a short time (lowest reading 523.6 kV.
NERC DAWG Report No. 13,1995, indicated that the low voltage condition was due
to a fault that resulted in the loss of 206 MVAR of capacitor banks and several
generating units that were providing voltage support. The voltage at Palo Verde
decreased from 529 kV to 523.6 kV, increased to 537.7 kV, and then stabilized at
532.8 kV after ECC requested the MVARs be adjusted to assist in returning the
voltage to normal. Of interest was the influence of the Palo Verde 1 on the
switchyard voltage.
The internal review of this report resulted in the additional events of interest that for
the purposes of better emphasizing some of the points in this report.
81. I
DC Cook Units 1 and 2, LER 315/99-022-01, Electrical Bus Degraded Voltage
Could Be Too Low For Safety Related Loads," June 23, 1999. Licensee electrical
analyses found the degraded voltage setpoints may be too low; the licensee sat the
relays so as to prevent spurious ESF actuation due to short voltage dips. The
licensee committed to make several modifications to reduce transformer loading
including the addition of a switchyard circuit breaker, one voltage regulating
transformer per train, and the replace of a few motor cables. The licensee also
planned to establish a working agreement between the American Electric Power
System Operations and the NPP so as to improve the minimum voltage during
sustained degraded voltage conditions.
82.1
DC Cook Units 1, LER 315/99-028, "ESF Actuation and Start of Emergency Diesel
Generator 1CD During Transformer Maintenance," December 16, 1999. With the
reactor a 0 power, inadvertent actuation of a protective relays started and loaded
one EDG. Of interest was that the licensee stated the cause of this event was
inadequate ownership interface between the NPP Maintenance Department and
American Electric Power (AEP) Division (transmission and distribution) personnel.
The LER also stated that there was an opportunity to resolve the lack of interface in
A-22
----- ---
that the corrective actions were similar to this event but insufficient to prevent
recurrence.
83.1
Diablo Canyon 1 & 2, LER 275/95-007, '230 kV System May Not Be Able To Meet
Its Design Requirements For All Conditions Due To Personnel Error," August 8,
1995. The 230 kV system may not be able to meet its design requirements for all
system loading conditions. Studies indicated that during peak loading, all
transmission lines and Morro Bay Power Plants 3 & 4 need to be in service to meet
Diablo Canyon plants' voltage requirements. The LER states that "An assessment
of past 230kV operability found that, 47 times in the last five years, the 230 KV
system should have been declared inoperable due to degraded voltages." A
subsequent Diablo Canyon 1 & 2 LER 275/96-005, Potential For Flashing in
Containment Fan Cooler Units," July 31, 1996, states that a review of past
configuration of the offsite power supplies found that it was degraded for
approximately 130 hours per year since i 990.
A-23
Table A-1 Types and Number of Grid Events 1994-2001
(The numbers in the table correspond to the event numbers in Appendix A)
Type of event
Number of reactor events
94
95
R
96
97
98
99
00
38
60
3
15
33
22
16
62
74
64
52
67
S
1
4
49
66
12
35
36
45
59
63
76
44
72
21
68
T
17
24
24
46
19
53
53
58
13
25
25
25
25
50
54
20
48
48
LOOP
full
at power
0 power
55
71
01
10
6
32
51
70
57
78
25
18
75
65
21
69
42
31
Partial LOOP
7
8
11
9
Total
12
111I
11
I10
10
61
16
1
73
43
4
77
37
37
9
7
10
3
Events are listed more than once indicating that the event affected more than one NPP
A-24
T
7
Table A-2 Event Summary
Table A-2 was prepared from the Appendix A, Grid Events. An explanation of the column
headings are as follows:
Column 1 - "No.," is the Table event number.
Column 2- "LER No.," is the Licensee Event Report (LER) number.
Column 3 - "Event Group," lists the event grouping codes as explained in Appendix A. In case
of loss of offsite power (LOOP) or partial LOOP, the recovery time was also noted.
Column 4 - "EDG Status," provides the response of the EDG to include the number of
emergency diesel generator (EDGs) that started, loaded, reloaded (if it was running to the grid
at the time of the event), or failed to run (FTR).
Column 5- "Degraded Grid," provides information about degradation of the grid that
contributed to the event as follows:
* "Fault." An "X" in this column indicates if equipment under control of the
transmission entity faulted.
* Elect" (Electrical). An "X" in this column indicates a weakness in the electrical
capability of the grid (or grid and NPP combined) to support the NPP offsite voltage.
* "HE" (Human Error). An "X" in this column indicates human error by personnel
that work for the transmission entity.
* "ADM" (Administrative Control). An "X" in this column indicates a lack of control of
administrative of the transmission entity's activities
* "EQPI (Equipment). This column lists equipment under control of the transmission
entity that failed or mis-operated (mis-op).
* "EOOS" (Equipment Out Of Service). An "X" in this column indicates that
equipment or facilities under control of the transmission entity were out of service at
the time of the event.
Column 6 - "Degraded Plant" indicates degraded nuclear plant equipment that contributed to
the event.
Column 7- "Observations" provides general observations and notes.
A-25
The following abbreviations were used in addition to those in the main text:
CB
CC
CT
CW
HP
RRP
SAT
TR
T-line
circuit breaker
coupling capacitor
current transformer
circulating water
horsepower
reactor recirculation pump
startup auxiliary transformer
transformer
transmission line
A-26
Table A-2 Event Summary
No.
LER No.
Event
Group
EDG
Status
Degraded Grid
Fault
1
219/94-007
Elect
S
HE
ADM
X
X
EOP
EOOS
Degraded
Plant
Observations
- New agreement between NPP and
transmission entity to strengthen control
-__________________and review of switchyard activities.
2
219/94-019
Transmission entity modification
defeated safety function of SBO power
supply; inoperable 4 to 5 months.
- Agreement between NPP and
transmission company to strengthen
review of activities affected SBO power
supply.
- Event demonstrates when SBO power
supply controlled by transmission entity
important to have agreement to provide
for review of Important SBO power
supply activities including post
modification and periodic tests to ensure
operability of SBO power supply.
l
-
.
3
219/97-010
R
4
220/94-002
S
5
220/96-004
I
All EDGsloaded
X
X
Relay
X
SAT voltage
regulator not
set
consistent
with design
- Licensee found that when the plant
tripped the regional grid voltage dropped
4.5% from heavy demand, EOOS, and
loss of station output. Additional 3-6%
voltage drop from load transfer.
analysis
- EOOS includes a 500 kV substation.
- EOOS Includes one of two generator
CB.
- Grid operator initiated 5% voltage
reduction quickly; one minute after from
loss of NMP1.
- EOOS includes P3.
A-27
Table A-2 Event Summary (Cont.)
No.
LER No.
Event
Group
EDG
Status
Degraded Grid
Fault
6
237/00-004
Elect
S
HE
ADM
X
X
ECP
EOOS
Degraded
Plant
Observations
- Need to ensure proper verification
practices when returning equipment to
service.
7
244/94-005
PL
23 min
EDG
reloaded
X
8
244/94.012
PL
30 min
EDG
loaded
X
9
244/97-002
PL
12 hr
EDG
loaded
10
244/98-005
PL
15 min
one EDG
loaded
34.5 kV
Cs
- Testing the EDG to the grid at time of
disturbance; reload successfully.
34.5 kV
T-line
- Radiation monitor program memory
lost upon loss of voltage.
X
34.5 kV
T-line
-
X
34.5 kV
cable
_ __ _ __ __ _ ___ __ _ _ _ _ __ _ _ __ __ ___ _ _s
11
247/94-001
PL
61 min
12
247/95-016
13
247/96-003
2/3
EDGs
loaded
X
p lice
X
138 kV
feed
S
X
relay
circuit
T
X
relay misop
14
247/96-021
I
X
765 kV
electric
reactor
A-28
Raccoon climbed a utility pole and
shorted two T-line phases.
_
_
-
Pilot wire relay had not been modified
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
at this location.
- Remote 765 kV fault de-energized
radiation monitor.
_
_
_
Table A-2 Event Summary (Cont.)
No.
LER No.
Event
Group
Degraded Grid
EDG
Status
Fault
15
247/97-018
one EDG
started
R
______
16
247/99-015
HE
X
ADM
EOP
EOOS
X
relay
mis-op
X
_______
EDGS
loaded;
one EDG
R
Elect
263/94-003
Degraded
protective
relay and TR
265/00-008
T
-
_ _ _ _ _ _ _ _ _ _ ___ _____ _
Overfrequency increased RCP speed.
Westinghouse found 'gross tilting" of
reactor internals to be limiting with
respect to allowable RCP flow and new
RCP flow Is more limiting than 125%
FSAR ilmitspeed approached gross
tilting.
- EOOS from T-llne and substation
outages reduced left one of two available
power generation paths unavailable.
- Overfrequency effects on running
-
-Analysis assumed automatic tap
changer was operable
-ASP 2.8E-06(ilcensee found 2E-04)
tap changer
-
energized.
______
Changeout of
CTs over
years
changed
operation of
relays In
response to a
345 kV
T-llne
X
___ ____ _
Synchronous motor/motor generator
sensitivity to momentary low voltage
(55% for 2-3 cycles fault).
- Emergency filtration 120v relays de-
345 kV
wave trap
________
18
Observations
safety m otors.
X
X
T
EOOS
disabled
generator
protective trip
__________
FTR
17
Degraded
Plant
____ ____
__ __ __ __ __
A-29
.__
_ _ _ __ _ __
g rid fa ult
- After fault Initially Isolated and reactor
tripped, 345 kV circuit breaker automatic
reclosed Into fault resulting In momentary
LOOP and load transfer to Unit 1.
Table A-2 Event Summary (Cont.)
No.
LER No.
Event
Group
19
270/95-002
T
20
270/97.002
T
EDG
Status
Degraded
Plant
Degraded Grid
Fault
Elect
HE
ADM
EOP
EOOS
Generator
protective
relay setpoint
in error
100 kV
T-line and
CB
X
Observations
Main
generator
voltage
regulator did
not respond
to loss of two
X
- Operability of main generator voltage
regulator important to NPP voltage
support and to prevent cascading (NPP
tripped following loss of two hydro units).
- Loss of programmable controllers.
hydro units
21
271/97-023
X
X
S
Turbine
runback
controls did
not work
X
correctly
22
271/98-016
R
one EDG
loaded
23
275/94-016
21
all EDGs
start
- Electric system could not support
simultaneous start two 5500 horsepower
feedwater pumps motors which tripped
on bus overcurrent minutes after unit trip.
X
X
X
X
A-30
- Plant assessed unfavorable grid
conditions and prepared for a dual unit
trip and LOOP.
- EOOS includes loss of several nearby
transmission lines and generators
several hours before the event.
- Many offsite sirens lost for 4 hours.
Table A-2 Event Summary (Cont.)
No.
LER No.
Event
Group
Fault
24
275/94-020
2T
25
275/96-012
528/96-004
4T
26
275/98-013
21
EDO
reloaded
Elect
HE
ADM
EOP
- 2 NPPs tripped, 4 others NPPs
affected.
- EDG 1-3 running to grid for test at time
of disturbance, successfully picked-up
safety load but tripped 45 minutes into
event.
- UPS sensitivity :Diablo Canyon and
WNP2 UPS trips; Palo Verde UPS
alarms.
- Effects of high(1 18%) voltage on safety
equipment.
- RCP undervoltage and underfrequency
trips Increased to maximum allowed by
Technical Specirication.
- Soaring temperatures wilted
transmission lines.
- EOOS Includes 3 500 kV T-lines in
Oregon, a 500/230 kV transformer, and
2000 MW of generation that weakened
the grid.
- Grid operated In a unanalyzed
condition that violated grid reliability
criteria would overload parallel
transmission lines.
- MTC level Influences the NPP
response to grid disturbance.
X
X
plant relay
misoperated
X
A-31
Observations
EOOS
T-line in
Idaho
X
X
all EDGs
started
Degraded
Plant
Degraded Grid
EDO
Status
- Relay setpoint changes due to
increased inrush current from new 230
kV circuit switcher, SAT replacement,
and new switchyard capacitor banks.
Table A-2 Event Summary (Cont.)
No.
LER No.
Event
Group
EDG
Status
all EDGs
started
27
275/01-001
21
28
277/96-007
21
29
277/01-001
i
power
transfer
to other
source
30
285/95-003
I
EDGs
started
31
286/97-008
LO
43 min
1 EDG
loaded,1
EDG
started
but FTR,
Degraded Grid
Fault
Elect
HE
ADM
EOP
230 kV
T-Iine
X
X
T-line
-Wildfire affecting grid and NPP a
repetitive event.
- Transmission restored in 73 min.
- Raccoon climbed utility pole and
shorted two phases.
- Safety buses transferred from
degraded offsite power supply to an
alternate power supply.
- Procedure deficiency left 2/4 EDGs per
unit inoperable for a LOOP for 3 hours.
- Reactor trip logic autostarts EDGs.
X
X
Observations
- Momentary LOOP due to remote
switching.
- Safety buses transferred from
degraded offsite power supply to an
alternate power supply.
X
X
EOOS
Degraded
Plant
X
138 kV
feed
1 EDOG in
32
286/00-008
S
X
control
cable
A-32
Faulted control cabling between P3,
and 138 kV and 345 kV control houses.
-
Table A-2 Event Summary (Cont.)
No.
LER No.
Event
Group
EDG
Status
all EDGs
loaded
33
289/97-007
R
34
293/97-007
1
35
311/95-004
S
Degraded Grid
Fault
Elect
X
X
HE
ADM
EOP
EOOS
X
230 kV
CB
Degraded
Plant
Observations
Slow to take corrective action; planned
to operated 4 days with 60-80% current
unbalance.
- Effect of unbalanced current on safety
related motors.
-
-Voltage regulating transformer
microprocessors sensitive to grid voltage!
transients.
X
- -...
..
---..
X
..
relay
...
X
- Manufacturers bulletin specified
corrective action, if implemented, would
have prevented protective relay mis-.
-..
operation.
*500 kV
CB control
36
313/95-009
S
37
316/00-004
2PLO
Unit 1&2
Train A
EDGs
loaded
38
318/96-001
R
one EDG
loaded
on each
unit
X
39
323/97-002
I
2/3
EDGs
start
X
- EOOS Includes 1of 2 generator CBs in
the switchyard.
- Transmission company switching error.
- Cook/AEP Interface agreement
planned.
X
X
X
- Voltage drops on loss of unit with
EOOS.
- EOOS includes 1 of 3 offsite T-lines.
X
- Momentary voltage drop due to bus
transfer from auxiliary to startup power.
- EDO autostarts if voltage recovery
more than 1 second.
A-33
Table A-2 Event Summary (Cont.)
No.
LER No.
Event
Group
EDG
Status
Degraded Grid
Fault
Elect
HE
ADM
EOP
EOOS
Degraded
Plant
Observations
40
323/97-003
l
2/3
EDGs
started
X
- Momentary voltage drop due to bus
transfer from auxiliary to startup power.
- EDG autostarts if voltage recovery
more than 1 second.
41
323/98-005
I
1/3
EDGs
started
X
- Momentary voltage drop due to bus
transfer from auxiliary to startup power.
- EDG autostarts if voltage recovery
more than 1 second.
42
324/94-008
LO
Unit 2
X
- Load dispatcher switching error.
EDGs
- Momentary LOOP.
loaded.
Unit 1
EDGs
started
43
325/00-001
LO
Unit 1
X
X
EDGs
loaded,
one EDG
FTR,
Unit 2
EDG
started
EDG
-
excitation
- Momentary LOOP.
EDG common mode failure.
system
inoperable for
unknown
duration
44
327/96-006
S
X
500 kV
-
45
328/95-007
S
X
161 kV
CB
-
cc
Synchronous motor sensitivity on both
units.
-
A-34
Switchyard fire.
Security system LOOP.
Table A-2 Event Summary (Cont.)
No.
LER No.
Event
Group
EDG
Status
46
334/94-005
T
one EDG
loaded
47
334/960-08
I
one
EDG
started
48
334/970-05
2T
Degraded Grid
Fault
335/94-007
ADM
EQP
EOOS
Observations
Unit 1Main
TR high
voltage
bushing
failed
- Transmission line protective relay
misoperation during voltage perturbation
following Unit 1 trip, tripped Unit 2 on
RCP underfrequency and caused a
PLOOP.
X
- Momentary voltage dip on bus transfer
and RCP restarts,
one EDG
started
S
HE
relay
mis-op
.
49
Elect
Degraded
Plant
--
X
-
345 kV
T-line;
relay
mIs-op
X
Short safety bus undervoltage trip time
of approximately 0.194 seconds explains
trip.
-
- EOOS Includes remote T-line relaying.
240 kV
- Switchyard fire.
PT
50
338/96-010
T
X
230 kV
T-line
51
338/00-004
S
X
500 kV
CB
52
341/98-001
S
2 relays
53
352/95-002
2TX
220 kV
T-line
A-35
Generator
relay
mis-oporatio
n
- Degraded transmission line protective
relays exposed during a test.
Table A-2 Event Summary (Cont.)
No.
LER No.
Event
Group
EDG
Status
Fault
54
_______________
X
X
T
353/96-004
Elect
Degraded Grid
.Plant
EOP
ADM
HE
Degraded
Observations
V/Hz relay
mis-op
- Modification work at remote facility trips
several transmission lines and
transformer resulting in grid instability.
EOOS
X
________
S
500 kV
CB
55
353/99006-01
X
56
373/94-011
57
373/01-001
S
58
382/95-002
T
59
388/95-005
S
60
400/96-008
R
ono EDG
started
X
230 kV
SW
61
410/98-006
PL
195
2/3
EDGs
X
345 kV
CB
min
loaded
500 kV circuit breaker grading
capacitor failure caused a voltage spike
that failed transformer lightning arrester.
-
Unit tripped while EDG being tested.
EDG tried to pickup grid and assumed
abnormal current level.
_
-
X
X
- Electrical perturbation from Unit 1 trip
tripped Unit 2 heater drain and caused a
Unit 2 load reduction.
345 kV
line
circuit
breaker FTO
on load
transfer
TR
one EDG
loaded
X
- Restart of reactor recirculation pump
motor caused an unexpected voltage
transient that tripped some plant
equipment.
cam SW
in 500 kV
CB
A-36
- ASP = 9.1 E-05
- Waterford 2 23.0kV fault sensed at
Waterford 3.
- One hour plant fire.
X
relay contact
bounce on
load transfer
EOOS Includes one of two generator
CBs.
-
Table A-2 Event Summary (Cont.)
No.
LER No.
62
Event
Group
410/99-010
EDG
Status
R
Degraded Grid
Fault
Elect
HE
ADM
2/3
EDGs
EOP
EOOS
Degraded
Plant
relay
Observations
-
Protective relay failure.
loaded
63
416/95-010
S
X
500 kV
CB CT
64
416/00-005
416/00-006
R
one EDG
loaded
X
X
500 kV
CB
,______
________ .______
______
65
. r
..
416/01-003
..
..
.
T
.
..
66
42594-001
S
67
443/98.014
S
68
445/97-009
S
69
454/98-017
L
8
X
.
_
.
.
500 kV
.
.
..
=
.
SW
500
kVCB
X
345 kV
CB
X
EDGs
loaded
455/00-001
S
- Partial load
EOCiRPT.
.
rejection did not actuate
X
Voltage drop from bus transfer and
start of 2 auxiliary feedwater pump
motors.
- Voltage transient caused 7 safety and
some non-safety motors tripped and did,...
not restart.
-
500 kV
CB
relay
hours
70
Partial load rejection did not actuate
reactor scram or end of cycle reactor
recirculation pump trip as expected.
-
Circuit breaker reclosed during power
restoration.
-
- Reactor stayed at power
X
345 kV
CB
A-37
- Static line fell on live line.
Table A-2 Event Summary (Cont.)
No.
LER No.
Event
Group
EDG
Status
Degraded Grid
Fault
Elect
HE
ADM
71
458/99-014
S
X
X
72
461/96-004
S
X
X
73
461/99-002
LO
10
hours
74
483/99-003
483/99-005
R
EDGs
loaded
EQP
EOOS
Degraded
Plant
Observations
- Voltage transient caused overcurrent
condition that tripped rod control and
information system map display.
138 kV
T-4ine
X
- Offsito power supply pole guy wire
pulled out, leaned and faulted.
X
- Related to deregulation-large amounts
of power being transported across the
country.
- Peak transmission loading.
- Grid operation changed such that wider
range of grid voltage expected at NPP.
75
483/00-002
T
76
498/95-013
S
X
one EDG
loaded
161 kV
T-line
X
-Transmission line fault persisted for 8
minutes due to neighboring utility
protective relay weakness.
- RCP and CW pump motors tripped on
negative phase sequence currents in
contrast to safety motors do not trip on
these currents.
relay
Grounded
protective
._______
77
499/99-003
__ _ __ _ _
PL
_
__
__
EDG C
loaded,
EDG B
x
345 kV
CB
F R
A-38
relay wiring
Table A-2 Event Summary (Cont.)
No.
LER No.
Event
Group
-
Fault
78
499/01-002
Elect
_
HE
ADM
EOP
EOOS
345 kV
-
528/95-001
- Grid operating entity had not
anticipated severity of NPP voltage drop
I
.____.____.__
80
528/95-003
TOTALS
CW tripped on current imbalance.
- high voltage alarm on safety bus.
.______ _CB
79
Observations
_Plant
X
S
Degraded
Degraded Grid
EDG
Status
I
from switching activities
-
-39
19
15
14
50
A-39
11
15
Influence of NPP on offsite voltage.
Table A-3 Event Causal Factors
(The numbers in the table correspond to the event numbers in Appendix A)
Event Group
Degraded Grid
Fault
R
33, 60, 64
Elect
3,15,16, 22,
HFE
38
Degraded Plant
ADM
15, 33,38
38, 64,74
EQP
15, 33, 60, 62,
EOOS
3,15, 60
3,15,16, 60
64
S
12, 21, 32, 44,
45, 49, 51, 55,
57, 63, 70, 78
57,59,66,67
1, 6, 21, 35,
71, 72,76
1, 6,21, 35,
68, 71,72
4,12,32,35,
36, 44,45, 49,
51, 52, 55, 57,
59, 63, 66, 67,
68, 69, 70, 76,
78
4, 35, 36, 66
21, 76
T
3,17,18,19,
24, 25, 50, 53,
54, 65, 75
20,25
54
54
13,17,18,19,
24, 46,48, 50,
53, 53, 58, 65,
75
25,48,65,75
18,19, 20, 21,46,
50, 54, 58
73
43
L
L
LO
PL
69
_
31,73
31,42,43,
7, 8, 9,10,11,
8,37
43
31,73
7, 8, 9,10,11,
61,77
61,77
A-40
Table A-4 Summary of Event Group Causal Factors
Event
Group
Fault
Electrical
Human
Degraded Grid
Administrative
Equipment
Equipment Out of
Error
Control
Failure
Service
Degraded Plant
R
3
7
1
3
5
3
4
S
12
4
7
7
21
4
2
T
11
2
1
1
13
4
8
L
1
0
0
0
1
0
0
|LO
2
3
1
2
1
1
L
PL
7
0
2
0
7
0
0
TOTALS
36
13
14
12
49
12
15
137
16
A-41
APPENDIX B
RISK ANALYSIS
Appendix B
Risk Analysis
This appendix contains the background, methods, and results of risk analyses that were used
for assessing average industry core damage frequency (CDF) from a station blackout (SBO)
before (1985-1996) and after (1997-2001) deregulation using simplified event trees. Several
after deregulation cases were investigated. The analyses required consideration of all losses of
offsite power (LOOPs) which were collected along with other operating data in Appendix C,
"LOOP and Scram Data 1985-2001."
Section B.1 provides a summary of the dominant characteristics of an SBO accident sequence,
Section B.2 develops simplified event trees, Section B.3 summarizes the method used to
calculate the CDF, and Section B.4 summarizes results.
B.1
Summary of the Dominant Characteristic of an SBO Accident Sequence
The NPP offsite power system is the "preferred source" of ac electric power, often referred to
as the grid. The safety function of the offsite power system is to provide power to ac safety
loads required to shut down the nuclear power plant (NPP). Onsite ac emergency power
supplies, usually emergency diesel generators (EDGs), automatically provide power to the
safety buses following a LOOP. These systems provide power for various safety functions,
including reactor core decay heat removal and other support systems required to preserve the
integrity of the reactor core and containment following a reactor trip.
A station blackout (SBO) is defined in Secti6n 50.2 as the "complete loss of electric power to
the essential and nonessential electric switchgear buses in an NPP (i.e., a LOOP concurrent
with a turbine trip and unavailability of the emergency ac power system)." The loss of all ac
power to reactor core decay heat removal and other support systems can result in core damage
within a few hours as follows: (1) core cooling failures, or loss of reactor core cooling integrity
(RCP seal failure) in 1 to 2 hours or (2) support system failures (e.g., batteries, compressed air,
HVAC) or design limitations (e.g., high suppression pool temperatures), typically for SBO
durations lasting more than four hours.
The principle parts of SBO accident sequence are: (1) the initiating LOOP-the frequency of a
LOOP, (2) the loss of onsite power-the unreliability of the onsite ac emergency power supplies
including common cause failures, (3) recovery-the likelihood that ac power will not be restored
before the core is damaged, and (4) core'damage probability-the event sequences that result
in core damage from the failure to recover ac power and consequently, the failure of decay heat
removal or support systems necessary to safely shutdown the reactor. Core cooling failures, or
loss of reactor core cooling integrity can occur in 1 to 2 hours.
B.2
Explanation of SBO Event Trees and Data
The contributors t the CDF from an SBO are: (1) reactor trip induced LOOPs (LOOPs-as a
consequence of a reactor trip, (i.e., some of the R events in Appendix A) and (2) grid (including
S and T LOOPs in Appendix A), weather, or'plant related LOOP induced reactor trip. The risk
contribution from LOOPs that do not result in a reactor trip (non-initiating) was considered
negligible; this data was collected in Appendix C for information only.
B-1
Simplified event trees were developed to represent the two principal contributors to the CDF
from an SBO. Figures B-1, "Reactor Trip-Consequential LOOP Event Tree," and B-2, "LOOP
Event Tree," show the event trees of interest. Figure B-1 represents a reactor trip induced
LOOP and Figure B-2 represents a LOOP induced reactor trip. The event trees end with n
outcome in terms of "OK meaning recovery without core damage and "CD" meaning some core
damage can be expected.
The data used in event trees are shown in Table B-1 and Appendix C. All of the data in
Table B-1 and Appendix C were from actual operating experience with the exception that the
critical reactor years for the summer months that were estimated as indicated in Table B-l.
Plant specific data could provide different results.
The following is a discussion of each element of the event tree.
(1) The initiators
In Figure B-1, the event is a LOOP as a consequence of a reactor trip which was
modeled in two steps. Figure B-1 shows this event is initiated the number of reactor
trips per critical reactor year (Rx-Trip/(RY)," and followed by "Consequential LOO '," the
probability of a LOOP given a reactor trip or P(LOOP/RT). Table B-1 shows the "reactor
trips/critical reactor year" and P(LOOP/RT) data.
In Figure B-2, the event is a LOOP that subsequently progresses to a reactor trip. In
Figure B-2, the event is initiated by the total number of grid (S and T events), weal her,
and plant LOOPs per critical reactor year, LOOP/RY." Table B-1 shows the
"LOOPs/RY" data.
(2) EDG unreliablity
Figures B-1 and B-2 show the events progress from a LOOP to UEDG' to reflect whether
the onsite emergency power supplies (EDGs), started and loaded, or failed to start and
load. The system failure rate for UEDG' was based on a two train EDG system and
calculated from the square of the individual EDG rates (P) plus the product of the
common mode (a) and EDG train failure rates (P squared +aP). A two train system is
typical of the NPP onsite power system; of 103 operating reactors, approximately
75 percent have 2 or less EDGs per reactor unit. So changes to the grid parameters
could be detected more easily, the same EDG data was used in the before and afler
analyses. Sensitivity analyses considered recent improvements in EDG unreliability
from 0.0033 to 0.0027 that reduced the risk by approximately 19 percent. All data used
was based on actual demand performance data published by the NRC as shown in
Table B-1. Table B-1 shows the "EDG failure rate for a two train system" data.
In some cases the EDG is unavailable for testing times up to 24 hours or out-of-service
(OOS) for allowed outage times (AOTs) up to 14 days. During the AOTs, the EDG
being serviced is often in some state of disassembly and unavailable so the two train
system is dependent on a single EDG to start and run for the full duration of the event.
B-2
Rx Trip-1RY
Consequential
LOOP
EDG
LOOP>4 hrs
Core Damage - 1/RY
Sequence
CCDP
OK
CD
OK
CD
.
OK
CD
OK
CD
Figure B-1 Reactor Trip - Consequential LOOP Event Tree
B-3
LOOP -1RY
EDG
LOOP 4hrs
Sequence CCDP
Core Damage -
OK
_ _ _ _ _ _ _ _
CD
|__
_
_
_
_
_
_
_
OK
CD
f________
OK
CD
Figure B-2 LOOP Event Tree
B-4
RY
Table B-1 Operating Data From LOOPS At Power Before and After Deregulation
Risk factor
Reactor trip
frequency_
Before 1985-1996
After 1997-2001
Before
After
Reactor trips
(Appendix C, Table C-6)
3161
441
1350
201
Critical reactor years (RY) (Appendix C,Table C-6)
940
442
392
184
441/442 =1.0
1350/392 = 3.4
201/184 =1.1
7
47
2
6
2
24
2
5
P(LOOP/RT)
7/3161 = 0.002
21441 =0.0045
2/1350 - 0.0015
2/201 - 0.01
LOOPs/RY
54/940 = 0.057
8/442 = 0.018
26/392 = 0.066
7/184 = 0.038
3161/940
Reactor trips/critical reactor years (RY)
LOOP Initiating
frequency
EDG reliability
& redundancy
Recovery time
Summer Months Only
' May 1 - September 30
All Year
Measurement
(Reference)
LOOPs
-Consequential (Appendix C, Tables C-1 and C-2)
-LOOP (Appendix C, Tables C-1, C-3, C-4, C-5)
EDG failure rate for a two train system
=
3.4
.0033 (Reference B.1 and B.2)
0.0027 calculated In SAPPHIRE
using 1997-2002 EPIX EDG data
(Ref B .3)
._______________
_______________
,0
7
1
4
0
7
1
4
13 (7/54)
63 (5/8)
27(7/26)
71 (5/7)
0.0074 (7/940)
0.011 (5/442)
0.018 (78/392)
0.0271 (5/184)
LOOP events exceeding 4 hours recovery time
-Consequential LOOP
-LOOP
Percent LOOPs > 4 hours
LOOP > 4 hours (number/RY)
LOOP at power 1.8E-04
Average CCDP (Reference B.2)
Plant capability
Note 1: May to September critical RY assumed to be 5/12 of total critical hours
References:
INEL-95/0035, "Emergency Diesel Generator Power System Reliability 1987-1993," February 1996.
5.1
NUREG/CR-5497, Common-Cause Failure Parameter Estimations," 1997.
B.2
Nuclear Regulatory Commission, Accident Sequence Precursor (ASP) Database.
5.3
B-5
(3) Recovery
Figures B-1 and B-2 show the events progress from "EDG" to "LOOP > 4hrs" to r lect
the percentage of LOOP events where it took more than four hours to recover. This
activity represents NPP and grid operators ability to restore ac power before exceeding
the SBO coping time.
The actual time power was restored was used in the analysis. The time that power
could have been restored by determining it was available and assuming it was reliable,
was also considered. These times are shown in Appendix C, Table C-1. As the data
indicates, this reduces the percentage of LOOPs more than 4 hours from 63 percent to
50 percent. This lowers the risk approximately 21 percent and will not change the order
of magnitude of the risks in Figure B-1.
The actual time power was restored could be considered overly conservative
considering that the operators may have restored power sooner under SBO conditions.
During the LOOP the NPP may have found it more prudent to stay on the EDGs fcr a
time to pursue more urgent tasks such as stabilizing plant systems. On then other
hand, the time power could have been made available may be optimistic as it relie; on
the assumption that offsite power was also reliable (would have worked). Recovery
from an SBO event, like a LOOP, will be specific to the event and circumstances and
there is likely to be a broad spectrum of responses. During an SBO, it is imperative that
the NPP establishes that offsite power is both truly available and reliable, and
expeditiously obtain these assurances. Like the LOOP experience, during an SBC
event, urgent operating tasks are also likely (e.g., maintaining the reactor water
inventory via connection of alternate water supplies or minimizing battery load).
Event 69 provides additional insights into how offsite power is actually restored. In this
case, if 8 hours and under, actual conditions would most likely have been done sooner.
In event 69, lightning caused a 345kV transmission line fault that opened two 345kV
circuit breakers at the NPP and two at the remote end of the transmission line, but had
no effect on the NPP. The event progressed to a LOOP at 100 percent power when a
345 kV circuit breaker supplying offsite power to the NPP opened upon reclosure of one
of the two NPP 345 kV circuit breakers due to failure a 345 kV transmission line relay
failure to reset, an inadequate NPP 345 kV switchyard alarm response procedure, and
improper 345 kV circuit breaker synchronization timing. At this point in the event both
EDGs started and loaded. The load dispatcher reclosed the remote circuit breakers
shortly after the LOOP occurred. However, the power restoration activities actually took
8 hours for coordination with the Nuclear Analysis Operational Department, walkdowns,
resetting relays, and visual inspection.
(4) Sequence conditional core damage probability (CCDP)
"Sequence CCDP" represents the likelihood of recovering or not recovering, ac powNer
for decay heat removal and other support systems necessary to safely shutdown
reactor. The CCDPs were obtained from the NRC ASP database by averaging the
CCDPs from 1980 to the present for all LOOPs at power (1.8E-04). In some case the
CCDP for some LOOP was less than E-06 and not in the ASP database; in these cases
a CCDP of zero was assigned for LOOP in determining the average. The CCDP
B-6
reflects actual demand performance and reflects the performance of the EDGs,
availability and reliability of alternate ac power supplies and cross-ties, use of
compensatory measures, operator performance, and fully credits overall NPP safety and
non-safety system redundancy and performance. However, the CCDPs typically credit
shorter recovery times than experienced so as to recognize that the NPP may have
restored power sooner under SBO conditions.
The CCDPs for sequences involving the failure of both EDGs was assumed to be an
approximately an order of magnitude higher (2.OE-03) than that for failure of the EDGs
with recovery (1.8E-4). Failure to recover in 4 hours was assumed to be approximately
another order of magnitude higher (2.OE-02).
B.3
Method
A baseline average industry CDF from an SBO before deregulation was calculated as the sum
of the CDFs leading to core damage in Figure B-1 and Figure B-2. The average industry CDF
from an SBO for the after deregulation cases were calculated using the sum of the CDFs
leading to core damage from Figure B-1 and Figure B-2 event trees. The data showed a need
to analyze the risks in the summers (May to September); all of the LOOPs since 1997 occurred
in the summer (May to September) in contrast to 23 of 54 LOOPs in the summers of
1985-1996.
The after deregulation cases were: (1) all LOOP data 1997-2001, (2) the summer months
(May-September), and three summer sensitivities cases based on actual experience (3) the
EDG out of service (OOS) for 14 days with a higher likelihood that grid will degrade,
(4) increasing in the amount of time that the grid is degraded, and (5) the EDG OOS for
14 days while the grid is
degraded. In each of the five
Risk Profile
*
cases, the risks after deregulation
were subtracted from the risks
X
before deregulation to obtain a
>Before
and Afer Deregulation
"delta CDF" and the results
o ^ .OOE0
displayed in Table B-2 and Figure
o
yE,. CCDP
14dayOOS
u
B-3.
at-
B.4 Results
C)
.
Ca 1.00E-05
assessment of the risk are
E
summarized in Table B-2,
"Changes In Risk After
Deregulation," and Figure B-3,
"Risk Profile. Table B-2 shows
the results in terms of a "delta
CDF" that was obtained by,
subtracting the CDF BEFORE'
deregulation from the CDF for the
particular case being analyzed.
Figure B-3, shows the CDF/RY
M
\crLIE46
,
.CD
The results of the Appendix B
-
-- =
__
IIE-06
2
0
1.OOE-07
'
Jan
2
Mar May
-Before
Jul
-After
Sep Nov Jan
-Summer
LU'
DG/Ave
--
30Day
Figure B-3 - Risk Profile
B-7
EDGANC
"Before" deregulation and the CDF/RY for the particular case being analyzed. The before
deregulation cases establish baselines to evaluate changes after deregulation. The average
risk reduction delta CDF' from SBO implementation was estimated to be 3.2E-05/RY (Rel. 1).
In Table B-2, a negative "delta CDF' indicates decreased risk since deregulation and the risk
reduction goals from SBO rule implementation have been maintained; and a positive "delta
CDP' indicates an increased risk since deregulation and that a portion of the risk reduction from
SBO rule implementation has been offset. Table B-2 also summarizes the change in the "delta
CDF' in terms of key data (the number of reactor trips per RY; the number of LOOPs/RY; the
P(LOOP/RT), and the LOOPs more than 4 hours as a percentage and as a number per FLY).
Table B-2 Changes in Risk After Deregulation
Observation
Baseline Change
-Delta CDIIRY
BEFORE
deregulation
1985-1996
Risk reduction from SBO rule 3.2E-05/RY
-Reactor trips/RY = 3.4
-LOOPs/RY = 0.05
-Probability (LOOP/reactor trip) = 0.002
-Percent LOOPs >4hours =17%
-(LOOPs > 4hours)/RY = 0.0074
0
AFTER
deregulation
1997-2001
Risk reduction from SBO rule implementation maintained.
CDF decreased below baseline due to offsetting changes:
-Reactor trips/RY =1.0
-LOOPs/RY = 0.014
-Probability(LOOP/reactor trip) = 0.0045
-Percent of LOOPs > 4 hours = 67%
-(LOOPs > 4 hours)/RY = 0.011
-0.9E-05
SUMMER
After deregulation
1997-2001
Risk reduction from SBO rule implementation maintained.
CDF decreased below baseline due to offsetting changes:
-Reactor trips/RY = 1.1
-LOOPs/RY = 0.021
-P(LOOP/reactor trip) = 0.01
-Percent LOOPs > 4 hours = 67%
-(LOOPs > 4 hours)/RY = 0.027
-0.5E-03
SUMMER
SENSITIVIlY
1997-2001
Risk reduction from SBO rule implementation partially or fully offset:
-EDG out-of-service for 14 days with a 0.01 chance of a degraded grid
-Increase time grid degraded to 30 days (based on experience)
-EDG out-of-service for 14 days with the grid degraded
0.8E-05
1.1E-0;5
7.7E-0
Appendix B, Table B-1 shows the key summer data for 1985-1996. Typical assessments of the
risks from an SBO use yearly averages to calculate risk and do not consider that the key
parameters affecting risk are different in the summer. Also, those assessments do not account
for long outage times on EDGs or for potential degraded grid conditions as measured by
P(LOOP/RT), both in the summer. This assessment noted that seven of the eight LOOPs
(87 percent) involving a reactor trip since 1997 occurred in the summer - May to Septemberin contrast to 23 of 54 (44 percent) LOOPs in the summers of 1985-1996. Prior to
deregulation, there was only a small difference in the likelihood of a LOOP between the
summer and the rest of the year. Thus the base case does not make a difference between the
summer and the year round.
B-8
In general, comparison data before and after deregulation shows significant changes in the key
data related to summer time LOOPs: the frequency of LOOP events at NPPs has decreased,
the average duration of LOOP events has increased, and P(LOOP/RT) has increased. The net
effect of these changes is that the risk reduction goals from SBO rule implementation'have
been maintained, except during summer time operations with EDG OOS or with the grid
degraded. The discussion below provides a detailed comparison.
Table B-2 indicates a negative delta CDF AFTER" deregulation indicating that
deregulation has not eroded the risk reduction from SBO rule implementation.
Comparison of the key factors in Table B-2 before and after deregulation help to explain
the decrease in the risk (i.e., the decreases in the number of reactor trips/RY and
number of LOOPs/RY have more than offset the increases in percentage of LOOPs
' more than 4 hours and probability of a LOOP given a reactor trip). P(LOOP/RT) is
0.0045 (as compared to 0.002 before deregulation) and corresponds to the grid being in
this condition approximately 40 hours per year. Figure B-3'shows the CDFIRY "After"
deregulation (1997-2001) have decreased below the risk "Before."
Table B-2 indicates that the "delta CDF" during the "SUMMER" is negative indicating
that deregulation has not eroded the risk reduction from SBO rule implementation.
Comparison of the key factors in Table B-2 before and after deregulation help to explain
the decrease in the risk (i.e., when averaged over the summer months [5/12's of the
each year from 1997-2001]) the decreases in the number of reactor trips/RY and
number of LOOPs/RY have more than offset the increases in the percentage of LOOPs
more than 4 hours and the probability of a LOOP given a reactor trip. P(LOOP/RT) is
0.01 and corresponds to the grid being in this condition approximately 88 hours per
year, all during the summer months (Appendix B, Table B-1 shows P(LOOP/RT) was
0.0015 during the summers of 1985.9.1996). Figure B-3 shows the CDF/RY for the
"Summer" after deregulation peaks from May to September, 1997-2001, slightly below
that "Before" deregulation. The peak reflects that 1997-2001 'the summer data has
been averaged over 5/12ths of the year rather than the entire year.
SUMMER SENSITIVITY studies performed to gauge the potential changes by averaging
the data over the summer for plant operations assuming (1) an EDG out of service
(OOS) for 14 days with a likelihood that the grid will be in degraded condition based on
operating experience, (2) increasing the amount of time that the grid is degraded to 30
days, and (3) an EDG taken OOS for 14 days with the grid degraded. TS approved
EDG OOS times typically range from 3 to .14 days. Operating experience shows that
the grid is degraded approximately 88 hours per year, (i.e. P[LOOP/RT]=0.01). Thirty
days was assumed to gauge the change in the risk during those times that a reactor trip
will result in a LOOP; specific analyses of the grid conditions being experienced would
provide the actual time a reactor trip may cause a LOOP.
Table B-2 delta CDFs indicates that in each of these three cases, the risk is positive,
indicating that the risk reduction from SBO rule implementation may be partially or fully
offset. In each of these cases, this risk increase may not be explicitly evaluated unless
the assessment considers (a) a consequential LOOP i.e. the results of electrical
analyses to determine whether a reactor trip will cause a LOOP and other LOOPs
separately (b) summer time operation and (c) actual demand performance under LOOP
B-9
conditions. Figure B-3 indicates that in each of the three cases, the risks are
represented as point estimates over portions of the summer months. The discussion
follows:
(1) The first sensitivity study estimated a change in risk as a result of having one of two
EDG OOS with a 0.01 chance that the grid is degraded, i.e. P(LOOP/RT=0.01).
Table B-2 indicates the "delta CDF" is slightly positive indicating the risk reduction from
SBO implementation has been partially offset. Figure B-3 shows this as a 14 day point
estimate in the risk as "DG/Ave" that is just above the risk "Before" deregulation. Figure
B-3 also shows the corresponding CCDP of 1.1 E-06 that was obtained by multiplying
14/365 and the CDF/RY for this case. As stated above plant specific analyses may yield
different results.
(2) The second sensitivity study evaluated the risk from an increase in the time that a
LOOP would have resulted from a reactor trip to approximately 30 days. Table B-2
indicates the "delta CDF" is positive indicating the risk reduction from SBO
implementation has been partially offset thus indicating that understanding the
percentage of the time a reactor trip can potentially cause a LOOP can be important.
Figure B-3 shows CDF/RY for this case as "30 day" that is above the risk Before"
deregulation.
(3) The worst case sensitivity study increases the risk above the Before" deregulation
values by assuming one EDG is unavailable for 14 days with the reactor at power and
the grid is degraded, (i.e., P[LOOP/RT]) is 1.0. As previously discussed, TS typicelly
allow one EDG to be unavailable for allowed outage times (AOTs) of up to 72 houis,
and in some cases with compensatory measures, up to 14 days. Table B-2 indica:es
the "delta CDF" is positive and indicates the risk reduction obtained from SBO rule
implementation has been fully offset. Figure B-3 shows this as a point estimate,
"EDG/WC," that is above the values before deregulation. Figure B-3 also shows the
corresponding CCDP of 3.OE-05 that was obtained by multiplying the 14/365 and the
CDF/RY for this case.
(4) Appendix B evaluated changes to the risks in Figure B-3 from: (a) recent
improvements in EDG unreliability from 0.0033 to 0.0027 that reduced the risk by
approximately 19 percent; (b) potentially shorter LOOP recovery times from
consideration of NRC data that assumes offsite power was available sooner than the
actual restoration time so as to reduce the risk by approximately 25 percent; (c) multiple
reactor trips (see Section 3.3.3.) that increase the risk by approximately 200-400
percent.
The NRC does not regulate the grid; however, the performance of offsite power is a major
factor for assessment of risk. As previously discussed the licensees are expected to assess
and manage the increase in the risk that may result from maintenance and outage activities;
NPPs should understand the condition of the grid before scheduling EDG, maintenance o,
AOTs.
B-10
APPENDIX C
LOOP AND SCRAM DATA FROM 1985-2001
Appendix C
LOOP and Scram Data From 1985-2001
The data in the tables below was obtained as follows:
The 1985-1996 LOOP data were obtained from NUREG/CR-5496, Evaluation of Loss of
Offsite Power Events at Nuclear Power Plants: 1980-1996," June 1998) and summarized in
Table C-2 through C-4.
The CCDP data was obtained from the NRC ASP database and summarized in Table C-1
through C-5.
The scram data in Table C-6 to include the number of reactor trips and number of critical hours
for 1985-1986 were obtained from NUREG-1272, "Report to the U.S. Nuclear Regulatory
Commission on Analysis and Evaluation of Operational Data-1 986," 1987. The same scram
data for 1987-2001 and summer were obtained from the NRC performance indicator data
maintained by INEL and SCSS.
Table C-1 LOOPs While At Power 1997-2001
LOOP
Category
LER
Plant
Event
Date
Recovery Time In Minutes
Actual
Consequential
LOOP (as a
result of a
reactor trip
LOOPs (with
reactor trip)
-
CCDP
Cause
heavy demand, 500 kV emergency OOS,
transmission company 34.5 kV voltage
regulator inoperable
Assumed
Availability
NRC
EPRI
219/97-010
Oyster
Creek 1
08/01/97
90 E
90
4040
<E-06
247/99-015
Indian
Point 2
08/31/99
612
444
720
2.8E-06
275100-004
Diablo
Canyon I
05/15/00
1980
480
2014
<E-06
Quad Cities
08102/01
265/01001
154
15
214
_________
346/98-006
Davis
Besse
06/24/98
1560
1359
1383
5.4E-04
443101-001
Seabrook
03/05/01
2236
43
0
-
456/98-003
Braidwood
09106198
688
528
528
<E-06
289/97-007
Three Mile
06/19/97
90
90
266/98-002
Point
01/08/98
600
-
.
.
Beach 1
LOOPs (no
reactor trip)
454/98-017
Byron 1
08/04198
I________
____
-
.
501 -
___
__
_______
_____
Table C-1 developed from the review of LERs as found in SCSS.
'Lcensee estimate on the order of 2E-04.
C-1
switchyard relay
tornado hit 345 kV switchyard
345 kV switchyard bushing flashovers from
wind blew plant cable Into plant
transformer/lightning strike to transmission
~~~line
230 kV switchyard circuit breaker failure
90
9.6E-06
-
<E-06
plant equipment failures
<E-06
errored plant recovery from lighting strike
.
.
_ ________
lightning hit 345 kV line, :noise,' and
snow
-
Non-Initiating
wildfire under 230 kV transmission lines
.
.__________
IslandI
plant LTC Inoperable 11 months and planned
grid operator response ineffective
_
I________
______tripped
345
kV transm ission
lines
Table C-2 Consequential LOOPS 1985-1996
LER No.
Plant
Event Date
Recovery Time
in Minutes
CCiP
237/90-002
Dresden 2
01/16/90
45E
3.4E.06
247/85-016
Indian Point 2
12112/85
20
5.8E-05
261/86-005
Robinson
01/28/86
100
3.OE-04
301/89-002
Point Beach 2
03/29/89
90
2.5E-04
311/86-007
Salem 2
08/26/86
1E
<E-06
395/89-012
Summer
07/11/89
130
1.5E.04
455/87-019
Bryon 2
01/16/90
1E
1.5E-
Table C-3 Grid-Related or Initiated LOOPs While At Power 1985-1996
LER No.
Plant(s)
Event
Date
Description
Recovery Time
in Minutes
CC:DP
6
7.1 -05
219/92-005
Oyster Creek
05/18/89
Transmission line fault due to
offsite fire
249/89-001
Dresden
03/25/89
Switchyard circuit breaker fault
45E
1.3E-05
251/85-011
Turkey Point 4
05/17/85
Multiple intense brush fires
shorted out three transmission
lines almost simultaneously
125
3.8!-05
271/91-009
Vermont Yankee
04/23/91
Switchyard human error during
battery restoration and
communication delays between
plant and transmission entity
277
2.9:--04
317/87-012
Calvert Cliffs 1&2
07/23/87
Faults on a transmission line
from tree contact
118
118
4.81-04
4.8E-04
327/92-027
Sequoyah 1
Sequoyah 2
12131/92
Grid configuration heavily
contributed to dual unit trip
95
95
1.8'_-04
11.8'--04
334/93-013
Beaver Valley 1
Beaver Valley 2
10/12193
Switchyard human error (HE)
caused dual unit trip
15
15
5.5-05
5.51-05
369/91-001
McGuire
02111/91
Switchyard human error while
40
2.61--04
testing circuit breaker
395/89-012
Summer
01/11/89
Grid instability
130
1.51-04
456/88-022
Braidwood
10/16/88
Transmission line potential
transformer failed at a remote
location
95
1.81--04
C-2
Table C-4 Plant Related LOOPs While At Power 1985-1996
Plant
LER Number
Event Date
Recovery Time
In Minutes
CCDP
029/91-000
Yankee-Rowe
06/15/91
24
6.1 E-04
206/85-017
San Onofre 1
11/21/85
4
9.4E-04
219/89-015
Oyster Creek
05/18/89
1
<E-06
237/85-034
Dresden 2
08/16/85
5
4.OE-05
255/87-024
Palisades
07/14/87
388
.
4.3E-04
261/92-017
Robinson 2
08/24/92
454
-
2.1 E-04
270/92-004
Oconee 2
10i19/92
57
2.1 E-04
293/93-022
Pilgrim
09/10/93
10
<E-06
301/89-002
Point Beach 2
03/29189
90E
2.5E-04
302/92-001
Crystal River 3
03127/92
20E
1.7E-05
304/91-002
Zion 2
03/21/91
60
2.1 E-04
309/88-006
Maine Yankee
08/13/88
14
1.2E-04
315/91-004
Cook 1
05/12/91
1E
<E-06
323/88-008
Diablo Canyon 2
- 07/17/88
38
4.1 E-05
324/89-009
Brunswick 2
06/17/89
90E
3.6E-05
325/86-024
Brunswick 1
09/13/86
1E
<E-06
336/88-011
Millstone 2
10/25/88
19
<E-06
370/93-008-2
McGuire
12/27/93
96
9.3E-05
373/93-015
LaSalle 1
09/14/93
15E
1.3E-04
409/85-019
La Crosse
10/22/85
60
2.05E-05
412/87-036
Beaver Valley 2
11/17/87
4
1.7E-05
414/96-001
Catawba 2
02/06/96
330
2.1 E-03
443/91-008
Seabrook
06/27/91
20
4.4E-05
458/86-002
River Bend
01/01/86
46
7E-05
528/85-058
Palo Verde 1
10/03/85
25
3.4E-05
528/85-076
Palo Verde 2
10/07/85
13
3.4E-05
C-3
-
Table C-5 Weather Related LOOPS While At Power 1985-1996
LER Number
Plant(s)
Event Date
Recovery Time in
Minutes
CCDP
245/85-018
Millstone 1
Millstone 2
09/27/85
09/27/85
21 E
330E
3.5E-0!5
3.5E-0!5
250/92-000
Turkey Point 3
Turkey Point 4
08/24/92
08/24/92
7950
7908
1.6E-04
1.6E-04
282/96-012
Prairie Island 1
Prairie Island 2
06/29/86
06/29/86
296
296
5.3E-05
5.3E-05
293/91-024
Pilgrim
10/30/91
120
1.2E-04
293/93-004
Pilgrim
03/13/93
1E
4.6E-0'S
Table C-6 Non-initiating LOOPs While At Power 1985-1996
Plant
LER Number
Event Date
Recovery Time
In Minutes
CCDP
220/90-023
Nine Mile Point 1
11/12/90
335
<E-06
220/93-007
Nine Mile Point 1
08/31/93
1E
<E-06
244/88-006
Ginna
07/16/88
65
<E-06
266/85-004
Point Beach 1
07/25/85
45E
<E-06
311/94-007
Salem 2
04/11/94
385
<E-06
457/96-001
Braidwood 2
01/18/96
113
<E-06
529/89-001
Palo Verde 2
01/03/89
1138
4.9E05
C-4
Table C-7 Annual Scrams and Critical Reactor Years 1985-2001
Year
Scrams
Critical Reactor Years
Scrams: May 1 to September 30
1985
552
59.44
210
1986
469
65.29
218
1987
404
70.24
177
1988
274
75.76
121
1989
244
76.04
96
1990
232
80.66
105
1991
196
83.94
87
1992
195
83.61
84
1993
162
82.90
59
1994
142
85.80
60
1995
154
88.84
75
1996
137
87.09
58
1997
84
79.93
32
1998
80
84.39
36
1999
95
90.73
54
2000
92
92.92
41
2001
90
93.96
38
3161
441
792
280
1350
201
Totals:
1985-1996
1997-2001
C-5
APPENDIX D
RESOLUTION OF COMMENTS
Appendix D
Resolution of Comments
A May 16, 2003, memorandum, Operating Experience Assessment- Effects of Grid Events on
Nuclear Power Plant Performance," was sent to several external stakeholders from
Farouk Eltawila, Director, Division of Systems Analysis and Regulatory Effectiveness, Office of
Nuclear Regulatory Research (Adams Package ML031360115). Identical letters were also
made publically available. The purpose of the May 16, 2003, memorandum was to obtain
comments regarding (1) the reasonableness of the approach used to assess grid reliability,
(2) the appropriateness of the conclusions, (3) and the need for additional sources of data that
could be used in the assessment. Letters with comments were received from Westinghouse,
the Nuclear Energy Institute (NEI), and the North American Electric Reliability Council (NERC).
Additionally, several internal comments were also received.
Each organization that provided comments is listed below, in order of the date received,
followed by a restatement of their comments verbatim and the resolution of each comment.
Italics were used to identify report text and bold italics to note revisions to the report.
Conforming changes were made throughout the report. Editorial comments were made but not
explicitly shown in the comment resolution.
D-1
D.1
Westinghouse Comment Resolution
Comments were received from Steven E. Farkas, Westinghouse, to William S. Raughley, NRC,
in a June 18, 2003, e-mail (ML033000272). We mailed suggested editorial comments in a
separate marked-up copy. The Westinghouse comments were numbered, restated verbatim,
followed by the resolution of each comment. Italics were used to identify report text and bold
italics to note revisions to the report. Conforming changes were made throughout the report.
Westinghouse also provided editorial comments that are not shown.
1.
Comment, Page 2
now: The NPP offsite power system is the "preferred source' of ac electric power, often referred
to as the grid.
suggest: The word "preferred" is not accurate. Some plants are set up to draw their own
power when available, e.g., Waterford 3 SUTs vs. UATs and fast-transfer back to SUTs pon
trip.
Resolution: Revised to state: "The NPP offsite power system is the 'preferred source'
of ac electric power for all conditions, including accident or postaccident, and is
often referredto as the grid."
2.
Comment, Page 3
now: The capacity and capability of the offsite power system are ensured through analyses
(discussed in Section 2.4).
suggest: The capacity and capability of the offsite power system are ensured through analyses
(discussed in Section 2.2).
Resolution: Revised to reflect the proper reference. In addition the sentence was
revised to state: "Grid operatingentities typicallyperform analyses to determine
the requirements and limits that are used in the operation of the system to ensure
adequate levels of power, voltage, and frequency following a disturbance."
3.
Comment, Page 3
now: ... electrical power to the essential and nonessential electric switchgear buses in an
NPP ...
suggest: ... electric power to the essential and nonessential switchgear in a NPP ... (switc-gear
is the equipment connected to the bus bars).
Resolution: No change required as the bus bars are an integral part of the switchgear.
D-2
4.
Comment, Page 9
now: ... The grid design and operating configurations were established before the electric power
industry was deregulated to ensure the correct voltages on the grid and at NPPs.
suggest: ... The assumptions about both grid design and operating configurations that ensure
correct voltages on both the grid and at NPPs typically date from before the electric power
industry was deregulated.
Resolution: Revised as suggested.
5.
Comment, Page 10
now: ... A follow up meeting was held on October 27, 2000 (Ref. 15) to discuss suggest: [The
sentence talks about meetings but does not refer to any conclusions or actions as a result of
them.]
Resolution: The text was revised: A followup meeting was held on October27, 2000
(Ref. 1) to discuss the status of NRC and industry grid reliability activities including the
Electric Power Research Institute (EPRI) Power Delivery Initiative for developing tools to
enhance grid reliability. The meeting resulted in actions to prepare for an industry
workshop, Grid Reliability Workshop" that took place in April, 2001.
6.
Comment, Page 13
now: definitions for L, PL and I refer to "in the grid" whereas event T refers to "in the
transmission system"
suggest: [using the term "the grid' consistently]
Resolution: Revised to use "NPP switchyard and transmission network" rather
than grid in the 1,PL, and I definitions.
7.
Comment, Page 14-15:
now: The "delta CDF" was obtained by subtracting the risk "BEFORE" deregulation from the
risks after deregulation. A negative delta CDF indicates the risks have decreased since
deregulation. A positive delta CDFs may offset the risk reduction obtained from SBO rule
implementation. Specifically a delta CDF of more than 0.6E-05/RY (the difference between the
risk reduction outcome and expectation from SBO rule implementation) and a delta CDF of
more than 3.2E-05/RY (the outcome from SBO rule implementation) partially and completely
offsets the risk reduction from SBO rule implementation, respectively.
suggest: [I've done PRAs for a while now and I'rn not even sure I know what the above
paragraph means. Here's my try.] The "delta-CDF" comes from subtracting the risk "BEFORE"
deregulation from the risks "AFTER" deregulation. A negative delta-CDF means risks have
gone down since deregulation. SBO rule implementation itself has caused delta-CDF to be
negative. A positive delta-CDF offsets both the benefits expected from SBO rule
implementation (0.6E-05/RY), and the actual risk reduction achieved with SBO rule
implementation (3.2E-05/RY).
,D-3
Resolution: 'The "delta CDF was obtained by subtracting the CDF "BEFORE"
deregulation from the CDF after deregulation. A negative delta-CDF means risk has
decreased since deregulation. SBO rule implementation itself resulted in a risk
reduction of 3.2E-05IRYprior to deregulation. Any positive delta CDFs since then
offsets the actual risk reduction obtained from SBO rule implementation."
8.
Comment, Page 16
now: ... as a spike in the risk as "EDG/Avg" that is just above the risk before deregulaticn [no
period]
suggest: ... as a spike in the risk as "DG/Avg" that is just above the risk before deregulation.
[DG/Avg is the label used on Figure 1]
Resolution: Revised as suggested.
9.
Comment, Page 18
now: ... group, which was dominated by grid and plant electrical weaknesses (see Section
3.3.2).
suggest: ... group, which was dominated by grid and plant electrical equipment weaknesses
(see Section 3.3.1)
Resolution: Revised as suggested.
10.
Comment, Page 18
now: ... shows changes in the percent of LOOPs more than four hours and median recovery
times
suggest: ... shows changes in the percent of LOOPs lasting more than four hours and median
recovery times.
Resolution: Revised as suggested
11.
Comment, Page 21
now: (3) Eight of the 10 R events took place in June, July, and August. Seven of the 10 events
were in the Northeast suggest: [the sentence does not consider the relative density of NPPs in
the Northeast. We need a good number for grid reliability" that, for the most part is not
dependent on the presence of a nuclear plant. For example, a power interruption to a large
fossil plant looks just like a LOOP at a nuclear plant in the process of estimating grid reliability.
We can assume that a grid disturbance that trips off any large electric generator should e
counted when trying to predict the frequency of LOOPs in a deregulated market.]
Resolution: Revised to state: "Eight of the 10 R events took place in June, July, and
August. Seven of the 10 events were in the Northeast (Maryland, New York, Neiv
Jersey, Pennsylvania, and Vermont where there are a total of 20 NPPs)."
D-4
12.
Comment, Page 34
A
now: 10. U.S. Nuclear Regulatory Commission, The Effects of Deregulation ...
suggest: 10. U.S. Nuclear Regulatory Commission, SECY 99-129, "The Effects of
Deregulation
Resolution: The references were revised to include both SECY-99-129 and the paper.
13.
Comment Appendix A, Item 38
now: type R
suggest: type S [work was in the switchyard providing power to RCPs]
Resolution: No change required. Observation is correct however that the event meets
the definition of an R event as the opening of 500kv circuit breakers resulted in a reactor
trip and a partial LOOP on 2 NPPs at one site. Had there not been a partial LOOP the
event would have been an S event.
14.
Comment Appendix A, Item 60
now: type R
suggest: type S [generator at issue is the one for the plant]
Resolution: No change required. Observation is correct however that the event meets
the definition of an R event as the opening of a 230kV circuit breaker disconnect switch
resulted in a reactor trip and a partial LOOP. Had there not been a partial LOOP the
event would hav6 been an S event.
15.
Comment Appendix A, Item 76
now: type T
suggest: type S [transformer protective circuit wiring is at the plant, not remote]
Resolution: Revised as suggested.
16.
Comment Appendix A, Item 79 and 80
now: Item 79 refers to 525kV for 2.5 minutes as an administrative limit. Item 80 refers to a
524kV for 10 seconds administrative limit.
suggest: revisit why these two administrative limits are different for the same plant, PVNGS-1
- 25Febl 999 vs. 29Jul1 999
Resolution: Both were reworded to state "the voltage dropped below the
administrativelimits for a short time." Palo Verde administrative limits vary as they
are predetermined based on a formula that reflects their operating status.
D-5
17.
Comment Appendix A Item 83
now: no type given
suggest: type I [eye]
Resolution: Revised as suggested.
18.
Comment, Table Al and Table Cl
now: no apparent relationship between the events cited in Appendix A (and
summarized on Table Al) with the counts shown on Table Cl
suggest: [using the knowledge from Appendix A to calculate initiating event
frequencies in Appendix C]
Resolution: No change required. Table Al is a summary of the grid events that
affected NPP performance from 1994-2001 as defined in Appendix A and the
assessment, and contains LOOPs where the grid played a major role but not other types
of LOOPs. Table C-1 is a summary of all of the LOOPs since 1997, of which four are in
Appendix A. The other LOOPs in table C-1 are weather related LOOPs and one plant
LOOP.
19.
Cost Comment Page ix
now: ... should include: (a) assessment of offsite power system reliability ...
suggest: [this is a notoriously complex calculation that requires real time
data from the grid operator]
Resolution: No change required. "The report states: Regarding (a)above, the
assessment of the power system reliabilityand risks from plant activities can be better
managed though coordination of EDG tests and outages with transmissionsystem
operatingconditions."
Regarding the data the executive summary states: "Recent experience shows that
actual gridparameters may be worse than those assumed in electricalanalyses due to
transmissionsystem loading, equipment out-of-service, lower than expected grid
reactive capabilities,and lower grid operating voltage limits and action levels. NP!'
design basis electrical analyses used to determine plant voltages should use electrical
parametersbased on realisticestimates of the impact of those conditions."
20.
Comment
Westinghouse provided several editorial suggestions that are not shown. In a telephone
conversation with W. Raughley, it was agreed that it would suffice that Westinghouse woLId
send a marked-up copy rather than take the time to write them out.
Resolution: With minor exceptions the report was revised to reflect the editorial suggestions.
D-6
D.2
Nuclear Energy Institute Comment Resolution
The comments below were provided in a letter (ML032060007) dated July 23, 2003, from
Alexander Marion, Nuclear Energy Institute, Director, Engineering Nuclear Generation Division
to Farouk Eltawila, Nuclear Regulatory Commission (NRC), Director-Division of System
Analysis and Regulatory Effectiveness, Office of Nuclear Regulatory Research. The NEI letter
paragraphs were numbered, restated verbatim, followed by the resolution of each comment.
Italics were used to identify report text and bold italics to note revisions to the report.
Conforming changes were made throughout the report.
1.
Comment
We appreciate the opportunity to review and comment on the subject report. It appears the
principle objectives of the NRC assessment of losses of offsite power (LOOP) are twofold:
1.
to determine the extent to which nuclear power plant (NPP) trips are causing
losses of offsite power (LOOP) and conversely, the extent to which LOOP are
causing plant trips; and
2.
to determine the extent to which deregulation in the electric power industry is
impacting plant trips and LOOP.
Resolution: The principal objectives stated in Section 1, "Introduction," were clarified
as follows: "The Nuclear Regulatory Commission (NRC) Office of Nuclear Regulatory
Research (RES) completed the work described in this report to identify and provide an
assessment of grid events and LOOPs at NPPs before deregulation (1985-1996) and
after deregulation (1997-2001). The objectives of the work were to use accumulated
operating experience from various sources to identify and assess (1) the numbers,
types, and causes of these events, (2) potential risk-significant issues (3) potential
challenges to the effectiveness of the NRC regulations, and (4) lessons learned. This
assessment is intended to identify changes to grid performance relative to NPPs which
could impact safety. The assessment also provides simplified numerical measures to
characterize grid performance before and after deregulation - in particular, those related
to loss of offsite power (LOOP). The information gathered provides a perfornance
baseline to gauge changes in grid operation by operating in a deregulated
environment."
2.
Comment
The assessment focused on two distinct periods of time: before deregulation
(1985-1996) and after deregulation (1997-2001). Although we recognize the merits of
periodically conducting such assessments of transmission grid performance and
associated impacts on nuclear power plant performance, it is imperative that such
assessments apply recognized methodologies and statistically valid bases especially
when making conclusions. The conclusions in the report offer no direct insights on the
impact of deregulation on LOOP or nuclear power plant performance. No data is
provided to identify which events included in the study occurred at plants, switchyards or
transmission grids that were subject to deregulation. Not all power generation and
D-7
transmission systems were deregulated in 1997 and clearly not all of these systems are
subject to deregulation today. Furthermore, not all electric utilities have decentralized in
divesting transmission services. Any conclusion regarding the impact of deregulation
cannot be substantiated without this important information.
Resolution: See resolution of comments 3 and 4 regarding the methodologies and
statistically valid bases.
Since the mid-1 996 all states and NPPs, regardless of their restructuring status, have
been exposed to revised power flows from open generator access to the transmission
system, (i.e., the grid has a direct impact on NPP even though some power generation
and transmission systems are not subject to restructuring today). Consequently, all of
the data since 1997 is in a deregulated environment and the final data analyses provide
direct insights in terms of changes in grid performance and NPP risk from operation in a
deregulated environment.
Operating experience supports that a NPP in a state that has not deregulated can be
affected by deregulation. As an example, in event 74 of the report the NPP was in a
state that had not restructured (the NPP is in Missouri and the DOE Web site mentioned
in the report indicates Missouri has not deregulated) however, the licensee found that
their failure to properly consider the impacts of deregulation (i.e., heavy grid loading
coupled with the loss of voltage support from the NPP generator) resulted in lower than
expected NPP safety bus voltage. As corrective action, the NPP made major
modifications and formalized its relationship with the grid operator even though it wias in
a state that had not restructured.
Section 2.4 of the report discusses deregulation in terms of: (1) formation of wholesale
generators by restructuring of the utility into separate transmission and generating
companies and (2) open access transmission. The report indicates that the utilities
divested their generating assets, not their transmission services as stated in the
comment. The report states that about 50 percent of the states have restructured, 50
percent either have not restructured or have no plans to restructure, and referenced a
Web site that provides the status and history of state deregulation initiatives. Accc rding
to the referenced Web site, 9 of the 10 LOOPs since 1997 are in states that have
deregulated, and one is in a state California that has deregulation on hold. Section 2.4
was revised to better summarize these effects as follows:
"In 1992, the National Energy Policy Act (NEPA) encouraged competition in the electric
power industry. NEPA requires, in part, open generator access to the transmission
system and statutory reforms to encourage the formation of wholesale generators. The
electric industry began deregulating after the April, 1996 issuance of FERC Order 688,
"PromotingWholesale Competition Through Open Access Non-discriminatory
Transmission Services by Public Utilities, Recovery of Stranded Costs by Public Ulifities
and Transmitting Utilities,' which requires that utility and nonutility generators have open
access to the electric power transmission system."
"Prior to deregulation of the electrical system, NRC licensees were both electrical
generators and transmission system operators. With economic deregulation, NRC
D-8
licensees no longer control the transmission system - typically, generation and
transmission are separate corporations. Wholesale generators resulted mostly from
State legislation that remove the generators from the regulated rate base so as to
allow them to compete for the sale of power in an open market. Utilities also
divested the generating assets; typically the switchyard remained part of the
transmission company. As a result of these changes there are more entities involved
in grid recovery that must be coordinated following any disturbance. A detailed state-bystate status is available on a Department of Energy (DOE) Web site and shows about
50 percent of the state utility regulatory commissions have orplan to deregulate, and 50
percent have no plans to deregulate or have put deregulation on hold."
"Initial licensing of NPPs included analyses of electrical system performance with certain
contingencies to assure reliable offsite power. Open access transmission generally
results in changes to the grid design and operation that could challenge operating
limits and grid reliability. The power market results in power transactions and
transmission of electricity over longer distances. Predicting the voltages and
current paths requires analyses of the conditions being experienced and these analyses
may no longer be valid. Grid operating entities and NPPs not involved in the power
transaction may see their operation affected by unexpected power flows. Regardless
of their restructuring status or participation in the power market, all states and
NPPs are exposed to design and operating challenges from the revised power
flows due to open transmission line access."
Comment
The report acknowledges a deviation from past studies in the' methodology for
characterizing grid events. The methodology combines plant-centered events and
switchyard events into the grid event category even though the initiating element was
not at the grid. For example, in many of the events treated in this manner, plant
electrical equipment is considered part of the transmission'grid rather than the plant. As
an example, refer to event numbers 16, 21, 22, 36, 51, 55, 60, and 62. Similarly, other
events whose cause was attributed to a malfunction in the plant switchyard are
categorized as grid events. We believe that such characterization of events will skew
the results and lead to incorrect conclusions. We believe that an event should not be
considered as grid initiated, if the initiating device, system, etc. would not exist if the
plant did not exist.
Resolution: For the purposes of our assessment of grid performance, the grid as
well as the plant, play major roles as evidenced in several events. Up to now, the focus
has been on the plant aspects of these events; this study investigates grid aspects of
these events. Section 3.0 explains the potential grid and risk aspects of LOOPs as a
result of a reactor trip. In addition, Appendix A defines the grid to start at the main and
station power transformer high voltage terminals and divides the grid into "S" switchyard events and T' - transmission system events, noting that this is the typical
boundary line between the NPP and the transmission entity.
The S and T events are reactor trips, not LOOPs, where the first sequence of events
leading to the trip was either in the switchyard or transmission system respectively;
D-9
subsequent sequence in the event involved the plant. The S (such as events 21, ,;6, 51,
and 55) and T events, and R events that were partial LOOPs (such as 22, 60, 62 ) were
not used in the data or risk analyses so the results are not skewed. Many of the events
noted in the comment involve the high voltage generator output circuit breakers in the
NPP switchyard. In practice, the transmission entity owns, tests, maintains, and assures
the operability of the equipment and the NPP only has a switch in the control room to
open and close the circuit breaker after coordinating with the load dispatcher.
The industry's proposed definition would eliminate many of the R, S, and T events in
Appendix A. Multiple perspectives, whether they be plant and grid, should encourage
the industry to take actions to prevent recurrence so as to minimize their impact on the
NPPs and risk to the public. At the current rate of these events and reactor trips, this
action could eliminate approximately 50 reactor trips, substantially reduce the overall
risk. A reactor trip challenges the plant and safety systems. Reducing the number of
trips will result in overall safety benefits. Section 3.2.2 was revised to state:
"The Table 1 R, S, and T events show approximately50 grid initiatedor related
reactortrips. Actions to prevent recurrenceappearto be justified as there are
risk benefits from a reduction In the number of trips.
Section 3.1 was revised to explain methodology in the text (as already explained in
Appendix A) and further acknowledge other views as indicated below. After the
paragraph that starts with "To be consistent with... "the following was added.
"For the purposes of this study a line of demarcationwas drawn between the
plant and the grid at the NPP main and station power transformerhigh-voltage
terminals. The grid was defined to Include: (a) the high- voltage switchyard or
substationnearest the NPP which is typically under the control of the
transmission organization,(b) the transmissionand generationsystem beyond
the switchyard or substation, and (c) the protective relaying and control circuits
of the switchyardand transmissionsystem which are often located inside ths
NPP. The boundary between the NPP and the grid was based on typical
organizationalresponsibilityfor equipment design, maintenance, and operational
control. In a deregulatedenvironment this boundaryIs typically the boundary
between the regulatedtransmission system company and the deregulatednuclear
generatingcompany.
After the paragraph that starts with "R events are losses ....... "the following was added.
The S and T events describedin Appendix A are reactortrips having major
switchyard or transmissionnetwork involvement, and were not used in the risk
analyses since they did not result in a LOOP. PastNRC studies typically velved
S and T as plant centered events due to the major role the plantplayed in the
event, e.g., turbine trips.
Lastly, Event 16, a LOOP as a consequence of a reactor trip, was the only event of the
ones mentioned that was used in the risk and data analyses. Event 16 was an R event
and the Appendix A event description will be revised to describe the grid problem. Also
D-1 0
Section 3.2.1 of the report will be revised to use the information from Event 16 (and
Event 3) to demonstrate that the probability of a LOOP given a reactor trip may, on an
individual plant bases, be more than we've estimated in the risk analyses. The Event 16
information includes:- (1) that licensee voltage analyses of a LOOP, as with reactor trip,
credits operation of the plant transformer automatic load tap change (LTC) and grid
operator action to raise voltage at the NPP using the upstream transformer LTC and
(2) that the plant automatic LTC had been inoperable for 11 months and normal
operating practice in such cases is to notify the grid operator so he can maintain the
required voltage until the LTC is repaired. Also the LTC was stuck on a lower tap, about
3 percent below where it is expected to be during normal power operation. This would
essentially raise the minimum required 138kV offsite power supply voltage from
98.5 percent to approximately 101.5 percent. As the 138kV would most likely be
operated below 101.5 percent a considerable percentage of the time, the probability of a
LOOP given a reactor trip was most likely quite high (approaching 1.0), a considerable
portion of the 11 months that the LTC was inoperable. Had the grid operator known
about the inoperable LTC, he could have compensated by keeping the voltage around
101.5 percent.
4.
Comment
Of particular concern is the treatment of emergency diesel generator (EDG) starts and
load runs. The report treats the EDG actuation as a LOOP and that LOOP duration is
predicated on how long the EDG operated rather than how long offsite power was
unavailable. The Electric Power Research Institute (EPRI) conducts annual
assessments of losses of offsite power.' A recent update included all events through
2002. We believe this would be a useful reference for NRC consideration. In preparing
its annual loss offsite power update, EPRI determines how long offsite power is truly
unavailable for each loss of offsite power event. In many events, backup offsite power
is available but is not needed and not used. For example, at most plants, following the
loss of offsite power to the safeguard buses, it is the plant management's decision to
power these buses from the EDGs, even though a totally acceptable option would be to
transfer to an available altermate offsite source. If powering these buses from the EDGs
is the selected first choice, it is often possible to transfer the safety buses quickly from
normal or backup offsite power if necessary. However, plant management frequently
finds it more prudent to stay on the EDGs for a time and pursue more urgent tasks such
as stabilizing plant systems.
Resolution: The short recovery times using NRC and EPRI data were shown in
Appendix C and the report was revised as'stated in-the resolution to NEI comment 7.
The NRC data is used when' predeterrhined criteria were satisfied. We reviewed and
referenced the EPRI 2001' report and the EPRI 2002 report that is a supplement to the
2001 report, in our study as'suggested. In addition, we compared the NRC and EPRI
LOOP durations for-events from 1990--2001 lasting longer than one hour (events
highlighted in ERPI report, Table'2-7) involving a reactor trip. The comparison found 6
events where' the NRC estimated longer durations than ERPI, four events where the
EPRI durations were'longer than the NRC, and six events where the NRC and EPRI
durations were the same. Essentially, the NRC and EPRI'data had little impact as
shown in the table below.
-D-11
Percentage of LOOPs trip>4 hours
All year
Summer
Before
After
Before
After
LOOPs with a
NRC -original
17
66
29
66
reactor trip
EPRI data based
on power
15
50
29
57
availability
Appendix B was revised to state
The actual time power was restored was used in the analysis. The time that
power could have been restoredby determining it was availableand assuming it
was reliable, was also considered. These times are shown in Appendix C,
Table C-1. As the data indicates this reduces the percentage of LOOPs more than
four hours from 66 percent to 50 percent and as indicated at the end of App.andix
B lowers the risk approximately25 percent and will not change the orderof
magnitude of the risks in Figure B1.
The actualtime power was restoredcould be considered overly conservative
consideringthat the operatorsmay have restoredpower sooner under SBO
conditions. During the LOOP the NPP may have found it more prudent to stay on
the EDGs for a time to pursue more urgent tasks such as stabilizingplant
systems. On then other hand, the time power could have been made available
may be optimistic as it relies on the assumption that offsite power was also
reliable(would have worked).
Recovery from SBO event, like a LOOP, will be specific to the event and
circumstances and there likely to be a broadspectrum of responses. Like the
LOOP experience, during an SBO urgent operating tasks are also likely
(e.g., maintainingthe reactorwater inventory via connection of alternate water
supplies or minimizing battery load). Duringan SBO it is imperative that the NPP
establish that offsite power both truly available and reliable,and expeditiou.;ly
obtain these assurances.
Event 69 provides additionalinsights into how offsite power is actually restored.
In this case it took 8 hours and under actual conditions would most likely have
been done sooner. In event 69, lightning caused a 345kV transmissionline fault
that opened tvo 345kV circuit breakers at the NPP and two at the remote end of
the transmission line, but had no effect on the NPP. The event progressedto a
LOOP at 100 percentpower when a 345 kV circuit breakersupplying offsite power
to the NPP opened upon reclosure of one of the two NPP 345 kV circuitbreakers
due to failure a 345 kV transmission line relay failure to reset, an inadequateNPP
345 kV switchyard alarm response procedure, and improper345 kV circuitbreaker
synchronization timing. At this point in the event both EDGs startedand loaded.
D-12
The load dispatcherreclosed the remote circuit breakers shortly after the LOOP
occurred. However, the power restorationactivities actually took 8 hours for
coordinationwith the Nuclear Analysis OperationalDppartment,walkdowns,
resetting relays, and visual inspection.
5.
Comment
The report indicates that the number of LOOP events is decreasing, but the median
duration is increasing. Although this statement is true, it can be misleading as well.
There have only been 4 long LOOP events since the beginning of 1998. Two
weather-related events occurred in 1998, one lasted 8:28 hours and one lasted 23:03
hours. There was a non-weather related LOOP in 1999 that lasted 12:00 hours and a
non-weather related LOOP in 2000 which lasted 33:34 hours. What has changed is the
frequency of plant-centered short duration LOOP, such that the total LOOP frequency
for a 5-year moving average has decreased from 0.056 LOOP per generating unit year
in 1993 to 0.0014 LOOP per generating unit year in 2002. This decrease is explained
by the fact that during the years 1998-2002 there have been only 7 losses of all offsite
power: 5 of these lasted longer than 4 hours, and 4 longer than 8 hours. The more
robust grids and switchyards reduced the incidents of minor, short duration LOOPS.
What remains are the LOOP events associated with weather and major equipment
failures.
The fact remains that the number of short, plant centered LOOPs has gone down
substantially, not that the number-of longer duration LOOP has increased. Obviously if
the frequency of short duration LOOP decreases, the median LOOP duration increases.
This report should include a more comprehensive discussion of such statistics.
Resolution: The report concludes that the LOOP/reactor year has been decreasing so
our observations regarding LOOP frequency are fundamentally the same as the
industry. The report concludes:
"The assessment found that major changes relatedto LOOPs after deregulation
compared to before include the following: (1) the frequency of LOOP events at NPPs
has decreased,..."
The report simply does not say that the number of LOOP events is decreasing, but the
median duration is increasing;" this is NEI's statement. The discussion of the median
was limited to comparisons of the' medians in this study to those in previous NRC
studies which used the medians as th6 recovery time measure.
The reports conclusion was revised to address'NEI's observation that the number of
short, plant centered LOOPs has gone down substantially asfollows.'
"While the data set is small, the number, types, and durationof LOOPs have
changedsince 1997. Recent experience indicates that there are fewer LOOPs.
Whereas most of the 1985-1996 LOOPs were of short duration and plantcentered, the most of the recent LOOPs are longer and had majorgrid
involvement from the reactortrip, severe weatheror lightning that affected the
D-13
NPP switchyard and transmission lines, or NPP switchyard equipment failures.
Further, based on historical data, power restoration times following a LOOP were
generally less than 4 hours; more recent LOOPs have lasted significantly longer. Also,
recent grid events, although not directly associated with LOOPs, indicate that grid
recovery times may be longer....."
Also the supporting discussion of the LOOP duration will be revised to state:
"While the data set is small, the nature of the numbers, duration, and types of the
LOOPs have changedsince 1997. Table 2 above the number of LOOPs has
decreased from .05/RYin 1985-1996 to 0.014/RYafter 1997. Based on historical
data, power restoration times following a LOOP were generally less than 4 ours.
Table 2 shows the percent of LOOPs lasting more than four hours has increased
from 15 percent (six weather related and one was plant centered)in 1985-1996 to
67 percent after 1997. The 1985-1996 data is dominated by short plant centered
LOOPs (median 20 minutes) whereas now there is a general absence of the short
duration plant centered LOOPs and longer duration LOOPs involving the gild now
dominate the frequency. Nine of the ten LOOPs since 1997 involved the grid or
severe weather that affected grid and included: two severe weather events
affecting the NPP switchyard, three events Involving lightning strikes to the
transmission lines, one wildfire involving schedule burning of brush under
transmission lines, one event due to a 230kV switchyard circuit breaker failure,
one event involving heavy power system demand and transmission company
equipment out of service, and one involving the lack of communication between
the NPP and the grid operator."
"Further analyses of the data in Appendix C found the median LOOP recovery
time increased from 60 minutes before 1997 to approximately 688 minutes vfter
1997. As anotherperspective, Appendix C, Table C-1 shows NRC data that
assumed offsite power was available before it was actually connected to one
safety bus; this data shows 50 percent of the eight LOOPs involving a reactor trip
lasted more than four hours and the median LOOP recovery time was estimated
to be 326 minutes."
6.
Comment
We are also concerned with the treatment of the probability of a LOOP as a
consequence of a reactor trip. The report contains a number of generalized conclusions
that are based upon questionable statistical techniques; for example, it states that the
probability of a LOOP given a trip has increased by a factor of 5 (from 0.002 to 0.')1).
The actual analysis in the report suggests that the overall probability has increased from
0.002 to 0.0045, a factor of 2.250. However, this is based upon 2 post-deregulatiDn
events. Statistically, it is not appropriate to draw conclusions from such a small sample
size. According to the event descriptions, one of the two events was actually an
operational problem that does not appear to be related to deregulation or grid
conditions. Thus, with only one event, the probability is essentially unchanged (0.002 to
0.0023). The factor of 5 appears to be based upon an unspecified culling of the cata
that is restricted to summer operations. This undermines the validity of the statistics.
D-14
Resolution: The treatment of the probability-of a LOOP as a consequence of a reactor
trip is reasonable arid technically sound. Our methods have detected changes that
potentially impact NPP operability and are masked by normal PRA methodology.
Our conclusions reflect that licensees should understand the condition of the grid to
properly assess the risk. Electrical engineering analyses can establish whether a unit
trip does or does not cause a LOOP. It is normal practice to consider that these
analyses consider realistic contingencies such as equipment failure or human error.
Use of proven plant specific electrical analyses to understand the risk appears to be
both pragmatically, technically, and economically superior to debates over individual
statistical preferences and interpretation of results.
To elaborate about the reasonableness of our methods, most PRA models have
screened out LOOPs as a consequence of a reactor trip due to their low frequency; it is
appropriate to periodically validate this assumption. In addition, the assessment shows
the probability of a LOOP as a consequence of a reactor trip has increased from 0.002
before deregulation to 0.0045 after deregulation when all of the data is considered, and
from 0.002 before deregulation to 0.01 after deregulation if the 1997-2001 summer data
is considered. Observing major changes in the data and risk due to summer operation,
May-September, and concluding that simple steps need to be taken to avoid the risks,
is a responsible departure from normal PRA methodology that is in the best interest of
the public rather than unspecified culling of the data. Inclusion of Event 16 in the risk
assessment is appropriate as it was a LOOP that occurred in the time period being
considered; whether it was grid related or no makes not difference (As mentioned
previously the report was revised to detail the grid aspects of Event 16.)
As shown below the sample size provides an adequate statistical basis as follows:
(1) The 2001 reversion of the EPRI report referenced in Comment 4 indicates five years
of data is enough; the EPRI report states 'Table 2-4 shows the loss of off-site power
experience for the most recent 5 years (1997-2001). The experience during an interval
such as the past 5 years is especially meaningful." The EPRI report goes on to note
that in the past (before 2001) a 3 year interval was used.
(2) NUREG-1 475, Applying Statistics," Table 21-3 indicates that the 2 post-deregulation
LOOPs 1997-2001 as a consequence of a 201 reactor trips meet a 95/95 statistical
criterion. NUREG-1475 indicates that this is very high quality data and validates the
EPRI observation that the 5 years of data is especially meaningful.
(3) Other ways used to assess the data include Bayes analysis using a Jeff erys
noninformative prior that indicates the mean is 0.0124 with a lower bound of .00286 and
an upper bound of 0.0273. In addition, classical statistical analysis with a 90 percent
D-15
confidence interval and maximum likelihood estimate would indicate that the mean is
0.00995 with a lower bound of .00177 and an upper bound of 0.0310.
Statistically, it appears that regardless of the statistical method 0.01 a valid result. Also
0.01 is in the lower part of the boundary interval, consequently the risks in Figure 1 may
be low.
7.
Comment
Lastly, we believe these concerns must be addressed in order for this report to provide
useful and valid information relative to the impact of grid events attributed to
deregulation. There are a number of assumptions and concluding statements mad in
the report that are derived from the methods for which we have expressed concerns as
noted above.
Resolution 7: The concerns have been addresses as stated above. Notwithstanding
that the assessment benefitted from revisions as a result of the industry's comments,
our data analyses, risk evaluation, and the report conclusions are essentially the same.
Regardless of the statistical analysis there are lessons learned that can benefit the
industry. Table 2 summarizes the risk discussion and indicates that in the summer the
risk reductions obtained from SBO rule implementation have been offset by these
statistics. The report also evaluates these statistics in the context of not achieving the
regulatory expectations.
Section 3.2.1 was revised to summarized the changes in the risk from the NEI
comments and those already stated in the report prior to the comment as follows:
"Appendix B evaluated changes to the risks in Figure 1 from: (a) recent
improvements in EDG unreliability from 0.0033 to 0.0027 that reduced the risk by
approximately 19 percent; (b) potentially shorter LOOP recovery times from
consideration of NRC data that assumes offsite power was available sooner than
the actual restoration time so as to reduce the risk by approximately 25 percent;
(c) multiple reactor trips (see Section 3.3.3.) that increase the risk by
approximately 200-400 percent; and (d) as stated in Appendix B, potentially low
CCDPs assumed in the recovery following the loss of all EDGs, and loss of ill
EDGs and failure to recover in four hours, that could increase the risk by a factor
of more than 200 percent. Collectively these factors indicate the risks in Figure 1
could be low."
8.
Comment
We would be pleased to meet with NRC staff to discuss this report in further detail. In
addition, we request that the staff consider a collaborative effort with industry to ccnduct
an improved assessment on the relationship between deregulation, grid events and
nuclear power plant safety. I will contact you to schedule a meeting.
Resolution 8: No revision required.
D-16
D.3
North American Electric Reliability Council Comment Resolution
The comments below were provided in a letter (ML032060020) dated July 23, 2003, from
David R. Nevius, Senior Vice President, North American Electric Reliability Council (NERC), to
Farouk Eltawila, Director, Division of Systems Analysis and Regulatory Effectiveness, Office of
Nuclear Regulatory Research. The NERC letter paragraphs were numbered, restated
verbatim, followed by the resolution of each comment. Italics were used to identify report text
and bold italics to note revisions to the report. Conforming changes were made throughout the
report. NERC also provided editorial comments that are not shown.
1.
Comment
Thank you for giving the North American Electric Reliability Council (NERC) the
opportunity to review and provide comments on your report, "Operating Experience
Assessment - Effects of Grid Events on Nuclear Power Plant Performance," April 29,
2003.
Resolution: No response required.
2.
Comment
To answer directly the questions posed in your May 16, 2003, letter, NERC believes that
the approach taken in the report is reasonable and that the conclusions reached are
appropriate. As far as additional sources of "data" are concerned, we think the best
source of useful information on grid performance relative to NPPs continues to be faceto-face discussions with and among grid operators, NPP licensees, and industry groups
such as NERC.
Resolution: The Foreword identifies possible uses of the report.
3.
Comment
NERC is pleased to see that the Commission recognizes in its report the important
interdependencies between the operation of the grid and the safe and reliable operation
of NPPs. It is essential that the Commission continue to work with licensees, grid
operators, and industry organizations, including NERC, to improve this understanding
and to facilitate more joint analyses of actual and potential grid operating conditions on
NPPs and vice versa. This is especially true in the area of grid voltage support and the
impact of voltage degradations on NPPs. in some cases, grid operators may not be
fully aware of the more restrictive bus voltage limits at NPPs, the condition of the grid
before the NPP takes its EDGs out of service for maintenance, or the pre-trip voltages
necessary for safe shutdown of the NPPs. These were evident from the discussion in
the report. In addition, the 1999 events in PJM, which are described on page 26 of your
report indicate that the Commission is well aware of the Transmission Control
Agreements in place between the California Independent System Operator and nuclear
licensees in that area. A key area for the Commission to explore is whether comparable
agreements are in place in other parts of the country between grid operators and NPPs,
D-17
and if grid operators are aware of the more restrictive grid voltage limits that NPPs
require.
Resolution: The Foreword identifies possible uses of the report.
4.
Comment
Another point in your report that deserves mention is the identified loss of 4,340 MVAR
of generator reactive capability that accompanied the 1,200 MW increase in electr c
output. In some cases, this loss of reactive capability could have a significant effec.t on
the ability of the grid operator to maintain adequate voltages on the grid. An increase in
real power output at NPPs is certainly desirable, but not if it comes at the expense of
increased risk of inadequate grid voltages. Some further investigation of this issue
seems warranted by licensees and their respective grid operators.
Resolution: The Foreword identifies possible uses of the report.
5.
Comment
There is no doubt that the interconnected grids, and the generators connected to them,
which serve North America are being operated and used somewhat differently today
than when the electricity industry was vertically integrated. However, there is no reason
this change in industry structure should adversely affect either the reliability of the grid
or the safe and reliable operation of NPPs. The events that were cited and analyzed in
your report provide a wealth of information and "lessons learned" that should be taken
seriously and acted upon by the Commission, licensees, and grid operators, both
individually and collectively.
Resolution: The Foreword of the report will acknowledge this comment.
6.
Comment
Please let me know if you have any questions about these comments, or if NERC can
assist the Commission in any way in pursuing the "lessons learned" identified in your
report.
Resolution: No change required.
7.
Comment
I have already spoken with Bill Raughley of your staff regarding several minor technical
comments on the report, which I have not repeated here.
Resolution: The report was revised as NERC suggested.
D-18
D.4
Other Comments
The internal comments below were provided informally on July 31, 2003, from the Division of
:
Risk and Reliability Assessm6fit o W.S. Raughley.
1.
Comment
Grid reliability conclusions do not appear to be supported by data. The observed
events/failures cited in the report are site related failures (switchyard or switchgear
failures) and not grid/network-related failures. Our data does not show any grid-related
loss of offsite power events during the 1997-2001 period.
Resolution: The conclusions are fully supported by data. The classification of events
is different than the past as explained in Section 3.1 of the report. Also see the
response to NEI Comment 3.
2.
Comment
The risk analysis in the report should take into account more than just the frequency of
LOSP events. Factors such as EDG reliabilities (which has improved substantially over
the last 10 years) should be taken into account. We also believe that the risk analysis
should be peer reviewed.
Resolution: The risk assessment already takes into the primary SBO risk factors to
include EDG reliability, as clearly explained in Appendix B pages B-1 though B-9. The
concept was to measure the grid so we kept the EDG reliability constant and used a
two-train EDG system failure rate of 0.0033 based on 1987-1993 EDG data. DRAA
advised that the corresponding value is 0.0027 based on 1997-2002 data.
Consideration of the 1997-2001 data made only a very small difference in the EDG
reliability-see the resolution to NEI Comment 7.
The risk analyses was peer reviewed by DRAA in December 2002. At that time the
major comment was that the CCDPs assumed for recovery from a LOOP with all EDGs
failed and after failure to recovery in four hours was low; the comment was noted in our
Appendix B.
3.
Comment
We agree that data shows that the average duration for LOSP events to be longer
during the 1997-2001 period. However, the durations for some events appear to be
overstated in the report.
Resolution: See resolution to NEI comment 4. DRAA LOOP recovery data was also
added to Appendix C, Table C-1. In addition DRRA and DSARE reconciled our LOOP
data in June 2003. In the end, this made only a small difference in the risk.
D-19
4.
Comment
Comparison of LOSP events data between the before and after deregulation time
periods may not be straight forward because of the number of events involved and the
differences in the grouping of events.
Resolution: These risks were assessed in Section 3.2 by comparing the risks from all
LOOP events before and after deregulation on an equal basis using Appendix B, "Event
Trees," and actual operating data which were gathered in Appendix C, "LOOP and
Scram Data, 1985-2001." See resolution to NEI comment 6 and 7.
D-20
NRC FORM 335
(2489)
U.S. NUCLEAR REGULATORY COMMISSION
DATA SHEET
NRCM 1102,
B
3201,3202
BIBLIOGflIXRPHIC
AA
1. REPORT NUMBER
(Assigned by NRC. Add Vol.. Supp., Rev.,
and Addendum Numbers, if any.)
HE
(See instnuctions on the reverse)
NUREG-1784
2. TITLE AND SUBTITLE
Operating Experience Assessment Effects of Grid Events on Nuclear Power Plant Performance
3._
DATEREPORTPUBLISHED
MONTH
YEAR
12
2003
4. FIN OR GRANT NUMBER
5. AUTHOR(S)
6. TYPE OF REPORT
W.S. Raughley, G. F. Lanik
7. PERIOD COVERED (Inclusive Dates)
1985 --- 2001
8. PERFORMING ORGANIZATION - NAME AND ADDRESS (ftNRC. provide Diision. OfficeorRegion, U.S. NuclearRegulatoryCommission. andmailingeddress:Ifcontractor.
provide name and mailing address.)
Division of Systems Analysis and Regulatory Effectiveness
Office of Nuclear Regulatory Research
U.S. Nuclear Regulatory Commission
Washington. D.C. 20555-0001
9. SPONSORING ORGANIZATION - NAME AND ADDRESS (IfNRC. type 'Sarne as above;M contractor. provide NRC Division. Oflice orRegion. U.S. NuclearRegulatoryComnission.
and mailing address)
Same as above
10. SUPPLEMENTARY NOTES
11. ABSTRACT (200 words orless)
Deregulation of the electrical industry has resulted In major changes to the structure of the industry over the past few years.
Whereas before, electric utilities produced the electricity and operated the transmission and distribution system, that is no longer
the case. In many states, the electric utilities have split Into separate generating companies, and transmission and distribution
companies. Most nuclear power plant (NPP) operators no longer have control of the transmission and distribution system
operations. NPPs rely on outside entities to maintain adequate reactive and voltage support for NPP operation. An assessment
was completed by the Office of Nuclear Regulatory Research (RES) to identify changes to grid performance relative to NPPs
which could impact safety. The assessment also provides some numerical measures to characterize grid performance before
and after deregulation - - in particular, those related to loss of offsite power (LOOP).
The information gathered provides a baseline of grid performance to gauge the impact of deregulation and changes in grid
operation. (This work was completed prior to the August 14, 2003, blackout that affected several states and Canada.) The
period 1985-1996 was considered before deregulation' and 1997-2001 after deregulation.' The assessment found that major
changes related to LOOPs after deregulation compared to before include the following: (1) the frequency of LOOP events at
NPPs has decreased; (2) the average duration of LOOP events has increased; (3) where before LOOPs occurred more or less
randomly throughout the year for 1997-2001* most LOOP events occurred during the summer; and (4) the probability of a
LOOP as a consequence of a reactor trip has Increased.
The assessment re-enforces the need for NPP licensees and NRC to understand the condition of the grid throughout the year to
assure that the risk due to potential grid conditions remains acceptable.
12. KEY WORDS/DESCRIPTORS (List words orphrases that winassist researchers In locating the report.)
nuclear power plant
loss of offsite power
grid
station blackout
emergency diesel generator
13. AVAILAB1LITY STATEMENT
unlimited
unliit
14.SECURITYCtASSIFICATION
1
(This Page)
unclassified
rThis Report)
unclassified
15. NUMBER OF PAGES
16. PRICE
NRC FORM 335 (2-89)
Federal Recycling Program
OPERATING EXPERIENCE ASSESSMENT - EFFECTS OF GRID
EVENTS ON NUCLEAR POVER PLANT PERFORMANCE
NUREG-1784
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFC-InAL nBUInESz nSm
OFFICIAL BUSINESS
2s
DECEM*IBER 2003